CVE-2026-85436
highMOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap me…
Vendor / product: Themoos — essential-moos
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-03 23:17
Modified: 2026-10-14 23:27
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
themoos / essential-moos <10.0.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pMOOSBridge/MOOSUDPLink.cpp#L171
Patch / mitigation: https://github.com/themoos/essential-moos/commit/613175fcf63fb9c6c5329c4ec57c2d18588b33e2
Patch / mitigation: https://github.com/themoos/essential-moos/pull/21
References
- https://github.com/themoos/essential-moos disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Es... disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/commit/613175fcf63fb9c6c5329c4ec57c2d18588b33e2 disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/pull/21 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pmoosbridge-heap-c... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗