themoos vulnerabilities

Products

• core-moos 12
• essential-moos 5
• ui-moos 1

Latest themoos CVEs

Newest publication first

1. CVE-2026-85454 MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling

   Published 2026-09-03

   Medium·CVSS 5.2 EPSS 0.32%

   MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one wr...

2. CVE-2026-85455 MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet

   Published 2026-09-03

   High·CVSS 8.8 EPSS 0.67%

   MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory befo...

3. CVE-2026-85453 MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting

   Published 2026-09-03

   Medium·CVSS 5.3 EPSS 0.34%

   MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interfa...

4. CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

   Published 2026-09-03

   High·CVSS 7.1 EPSS 0.36%

   MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to tri...

5. CVE-2026-85452 MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers

   Published 2026-09-03

   High·CVSS 8.7 EPSS 0.69%

   MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers t...

6. CVE-2026-85450 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion

   Published 2026-09-03

   High·CVSS 8.7 EPSS 0.63%

   MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service...

7. CVE-2026-85443 MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service

   Published 2026-09-03

   High·CVSS 8.7 EPSS 0.63%

   MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no da...

8. CVE-2026-85442 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

   Published 2026-09-03

   High·CVSS 8.7 EPSS 0.76%

   MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhau...

9. CVE-2026-85440 MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length

   Published 2026-09-03

   Critical·CVSS 9.3 EPSS 1.0%

   MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and neg...

10. CVE-2026-85441 MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length

    Published 2026-09-03

    High·CVSS 8.7 EPSS 0.66%

    MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the databa...

11. CVE-2026-85436 MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length

    Published 2026-09-03

    High·CVSS 8.7 EPSS 2.1%

    MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UD...

12. CVE-2026-85433 MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration

    Published 2026-09-03

    Critical·CVSS 9.3 EPSS 0.77%

    MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners o...

13. CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

    Published 2026-09-03

    High·CVSS 8.8 EPSS 0.51%

    MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel thi...

14. CVE-2026-85431 MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection

    Published 2026-09-03

    High·CVSS 8.7 EPSS 3.4%

    MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with...

15. CVE-2026-85430 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

    Published 2026-09-03

    High·CVSS 8.8 EPSS 1.7%

    MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messag...

16. CVE-2026-85428 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

    Published 2026-09-03

    Critical·CVSS 9.3 EPSS 0.81%

    MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS v...

17. CVE-2026-85427 MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE

    Published 2026-09-03

    Critical·CVSS 9.2 EPSS 0.55%

    MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run...

18. CVE-2026-85424 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR

    Published 2026-09-03

    Critical·CVSS 9.3 EPSS 0.81%

    MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.