CVE-2026-85436
MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length
Published Sep 3, 2026 · updated Oct 14, 2026 · themoos essential-moos
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 3, 2026 · NIST NVD
Detected
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption a
Oct 14, 2026 · NIST NVD
Updated
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption a
Affected
- cpe themoos/essential-moosversion unspecified
- vendor themoos essential-moosversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-85436
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UD
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-85436
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-85436
30-day exploitation probability 2.1%
first.org - NIST NVDVulnerability recordCVE-2026-85436
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UD
nvd.nist.gov