Description

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:23.740Z",
  "pubdate": "2026-09-03T23:17:23.740Z",
  "executiveSummary": "The MOOS core-moos library, specifically versions up to 10.4.0, contains an improper input validation vulnerability within the CMOOSMsg::operator>> function.\nThis flaw allows an unauthenticated remote attacker to cause a denial-of-service (DoS) condition by injecting a malformed message containing a negative length value into the MOOSDB process.\nThe vulnerability resides in the deserialization logic where the length of a string component is processed without validating that the value is non-negative.\nWhen a negative length is provided, the application encounters an unhandled exception during the message parsing process, leading to the immediate termination of the MOOSDB database process.\nThis vulnerability poses a significant risk to the availability of the MOOS environment, as any attacker with network access to the MOOSDB port can crash the database, effectively halting all associated inter-process communication and robotics/autonomous system coordination.\nNo authentication is required to initiate the attack, making it reachable from any point in the network that has access to the MOOSDB port.",
  "technicalDetails": "The vulnerability is situated within the deserialization logic of the MOOS core-moos communication stack, specifically within the CMOOSMsg::operator>> function. This function is responsible for reconstructing message objects from raw byte streams received over the network.\nThe root cause of this vulnerability is the absence of a sanity check on the length field of serialized strings within the incoming network packet. In the vulnerable implementation, the code reads a length value from the stream and uses it to allocate or manipulate memory without first verifying that the length is a non-negative integer.\nWhen a malicious actor sends a crafted message to the MOOSDB listening port, they can specify an arbitrarily large negative integer for the string length field. Because the underlying logic does not validate this constraint, the deserialization routine attempts to process this invalid length value.\nDuring the execution of CMOOSMsg::operator>>, the negative value causes an error state during the buffer reading or memory management phase. This discrepancy triggers an unhandled exception, as the application logic assumes the length value is always within the domain of valid unsigned memory sizes. The lack of an exception handler for this specific failure scenario causes the runtime environment to abort the execution of the process.\nExploitation does not require prior authentication or elevated privileges. An attacker simply needs to establish a network connection to the MOOSDB service and transmit a malformed data frame containing the negative length parameter. Once the MOOSDB process receives the packet, the parser enters the vulnerable code path, triggers the exception, and terminates.\nThe impact of a successful exploitation is a complete denial-of-service for the MOOSDB process. In complex autonomous systems, the MOOSDB serves as the centralized message hub for state distribution and task coordination. Terminating this service results in the failure of all connected clients to communicate, potentially leading to system-wide instability, loss of control over autonomous agents, or the cessation of critical data telemetry. The vulnerability is persistent, as the process crash will occur every time the malicious payload is transmitted, assuming the service does not automatically restart, or until the underlying code is patched to enforce input validation constraints."
}