Description

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:22.937Z",
  "pubdate": "2026-09-03T23:17:22.937Z",
  "executiveSummary": "The MOOS essential-moos software, up to and including version 10.0.1, is susceptible to a critical heap-based buffer overflow vulnerability.\nThe vulnerability resides within the CMOOSUDPLink::ReadPktFromArray() function, which fails to properly validate the length field of incoming UDP datagrams.\nAn unauthenticated, remote attacker can exploit this flaw by transmitting a crafted UDP packet containing a negative value in the packet length field.\nWhen processed, this value triggers an oversized memcpy operation, resulting in memory corruption outside the allocated bounds of the destination buffer.\nThis behavior facilitates arbitrary heap corruption, leading to a Denial of Service (DoS) state, and potentially providing a primitive for remote code execution.\nThe vulnerability is reachable via the configured UDPListen port, requiring only network connectivity to the target service.\nGiven the nature of heap corruption, successful exploitation reliably compromises the stability of the MOOS process, posing a significant risk to the availability and integrity of the system.",
  "technicalDetails": "The vulnerability is situated within the CMOOSUDPLink::ReadPktFromArray() function of the essential-moos library. The function is designed to handle packet reception and processing for UDP communications; however, it fails to implement strict bounds checking on the length header provided within the UDP payload.\nThe root cause is an integer handling vulnerability where the application interprets a signed length field from an incoming datagram without verifying that the value is positive and within the constraints of the target buffer size.\nWhen an attacker sends a UDP packet where the declared length is a negative integer, the subsequent logic passes this value to an underlying memcpy operation. In C++, if the size argument is treated as an unsigned integer during the memcpy invocation, the negative signed integer is cast to a very large positive value (e.g., a two's complement conversion).\nThis forced conversion results in the memcpy operation attempting to copy a massive amount of data into the destination heap buffer. Since the destination buffer is significantly smaller than the value derived from the negative input, the write operation exceeds the heap chunk boundaries.\nThe attack flow proceeds as follows: 1) The attacker identifies the configured UDPListen port utilized by the target MOOS process. 2) The attacker constructs a malicious UDP datagram containing a negative length field. 3) The attacker transmits the packet to the target's UDPListen port. 4) The CMOOSUDPLink::ReadPktFromArray() function reads the packet header and fails to validate the length field. 5) The function invokes memcpy with a large unsigned size derived from the negative input. 6) The heap memory surrounding the destination buffer is corrupted, overwriting adjacent data structures, object pointers, or function pointers.\nExploitation does not require authentication or elevated privileges, provided the attacker has network access to the UDP port. The post-exploitation impact includes the immediate termination of the MOOS process (DoS) or the potential for controlled heap grooming to achieve arbitrary code execution by overwriting critical application metadata or control flow structures.\nThe vulnerability affects all versions of essential-moos up to and including 10.0.1. No specific input filtering is present to mitigate the inclusion of negative integers in the packet header prior to the memory copy operation."
}