ZeroDay Findings
Sign inSign up

Findings

CVE-2026-85440

MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

Published Sep 3, 2026 · updated Oct 14, 2026 · themoos core-moos

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 3, 2026 · NIST NVD

    Detected

    MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

  2. Oct 14, 2026 · NIST NVD

    Updated

    MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

Affected

  • cpe themoos/core-moosversion unspecified
  • vendor themoos core-moosversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-85440

    MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and neg

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-85440

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-85440

    30-day exploitation probability 1.0%

    first.org
  • NIST NVDVulnerability recordCVE-2026-85440

    MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and neg

    nvd.nist.gov

References