PatchTheCVECVE-2026-85442: MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(),
CVE-2026-85442 is a high-severity flaw (CVSS 7.5) affecting core-moos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | No |
| Weakness | CWE-789 |
| Published | 2026-09-03 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-85442?
core-moos: upgrade to 10.4.0. Exact commands for each OS are on this page.
Is CVE-2026-85442 being exploited?
CVE-2026-85442 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-85442 affect?
CVE-2026-85442 affects core-moos. Severity is high (CVSS 7.5). MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send pack
How urgent is CVE-2026-85442?
Priority 45/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-85455 HIGH 8.2 UPGRADE MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte pack
- CVE-2026-85454 MEDIUM 6.1 UPGRADE MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that
- CVE-2026-85453 MEDIUM 6.1 UPGRADE MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing att
- CVE-2026-85451 HIGH 7.1 UPGRADE MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper compo
- CVE-2026-85450 HIGH 7.5 UPGRADE MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that create