Description

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:23.590Z",
  "pubdate": "2026-09-03T23:17:23.590Z",
  "executiveSummary": "A critical pre-authentication heap overflow vulnerability exists in MOOS core-moos versions up to 10.4.0.\nThe vulnerability resides in the MOOSCommPkt packet handling mechanism, specifically during the HandShake phase.\nA remote, unauthenticated attacker can exploit this flaw by sending a maliciously crafted packet with a negative length field.\nSuccessful exploitation allows for arbitrary data writes to the heap, which can lead to remote code execution, denial-of-service, or total system compromise.\nThe vulnerability is particularly dangerous as it occurs before authentication, meaning no valid credentials are required to trigger the overflow.\nThe root cause is an insecure signed integer check within the InflateTo() function, which fails to correctly sanitize packet lengths before memory allocation and data copying operations via recv().\nGiven that MOOS is often used in robotics and autonomous systems, the impact of such a remote compromise could be severe, potentially allowing for the unauthorized control of remote assets.\nOperators are advised to restrict network access to affected services immediately.",
  "technicalDetails": "The vulnerability is located within the MOOSCommPkt packet processing subsystem of the MOOS core-moos framework. The flaw is triggered during the HandShake phase, which occurs prior to any authentication protocols, exposing the system to external network actors.\nThe root cause stems from a signed integer validation error in the InflateTo() function. The code performs a check on the packet length field but fails to adequately handle negative values. When a negative value is passed in the length field of the MOOSCommPkt structure, the application's subsequent logic—which expects an unsigned length for memory allocation—interprets this value incorrectly.\nSpecifically, when the length is passed to the recv() system call, the negative integer is cast to an unsigned type. This transformation results in an unexpectedly large size value. The application attempts to allocate a four-byte buffer on the heap based on the initial structure design, but the subsequent recv() operation proceeds to write data into this insufficient buffer area based on the oversized, erroneously interpreted length.\nThe attack flow proceeds as follows: 1) The attacker initiates a connection to the MOOS service. 2) The attacker sends a malformed HandShake packet containing a negative value in the length header field. 3) The InflateTo() function fails to reject the negative integer. 4) The application allocates a small, four-byte heap buffer. 5) The recv() function is invoked to copy incoming data into this buffer, utilizing the now-coerced, large unsigned length. 6) The resulting heap overflow overwrites adjacent memory structures.\nBecause the overflow occurs on the heap, an attacker can manipulate heap metadata or overwrite functional pointers, leading to arbitrary code execution within the context of the MOOS process. The lack of authentication requirements means that any entity with network access to the MOOS communication port can trigger this memory corruption. Post-exploitation impact includes full control over the MOOS node, potentially allowing for injection of malicious control commands or exfiltration of sensitive mission data.\nThe vulnerability is present in all versions of MOOS core-moos through 10.4.0."
}