Description

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:23.883Z",
  "pubdate": "2026-09-03T23:17:23.883Z",
  "executiveSummary": "MOOS core-moos versions through 10.4.0 contain a critical vulnerability in the packet handling logic of the communication subsystem. The flaw is categorized as an improper input validation issue, specifically concerning the processing of packet length declarations during the communication lifecycle.\nThe vulnerability allows an unauthenticated remote attacker to trigger an unbounded memory allocation by transmitting a maliciously crafted wire packet. By specifying an excessively large length value within the packet header, the attacker can force the server to allocate memory proportional to the declared size before verifying the actual payload or completing client authentication.\nSuccessful exploitation results in a Denial of Service (DoS) condition, as the server's heap memory is rapidly exhausted, leading to application crashes or system instability. This vulnerability is particularly severe because it is reachable prior to authentication, exposing the service to any network-adjacent attacker capable of sending TCP packets to the MOOS communication port. The risk profile is high, as it requires minimal effort to disrupt service availability on affected systems.",
  "technicalDetails": "The vulnerability resides within the CMOOSCommPkt::OnBytesWritten() function of the MOOS communication library. This component is responsible for parsing incoming network data and preparing buffers for packet reconstruction. The core issue is an absence of sanity checking on the length field specified in the wire protocol packet header. When a packet is received, the application reads the declared length and proceeds to allocate memory buffers to store the incoming payload.\nBecause the logic fails to enforce a maximum threshold or validate the declared length against the actual incoming data volume, the application performs an unbounded allocation based solely on untrusted input from the network stream. The attack flow begins with an unauthenticated attacker initiating a TCP connection to the target MOOS instance. Once the connection is established, the attacker transmits a crafted wire packet containing a header with a large integer value in the length field.\nUpon receiving this packet, the CMOOSCommPkt::OnBytesWritten() function parses the header and immediately invokes an allocation routine—likely a dynamic memory allocation—to reserve memory for the incoming data stream. By submitting multiple such packets or a single packet with an extremely large length value, an attacker can cause the process to request a memory block that exceeds available physical memory or virtual memory limits. This leads to heap exhaustion, memory fragmentation, or an unhandled out-of-memory (OOM) exception.\nThis vulnerability is effectively an 'Allocation of Resources Without Limits or Throttling' (CWE-770). Since the processing of these headers occurs before the authentication handshake is finalized, the server provides a primitive that can be abused without any credentials or elevated privileges. The network exposure is total for any system where the MOOS communication port is reachable. The post-exploitation impact is exclusively focused on resource depletion and service disruption, as the mechanism is strictly an allocation-based DoS rather than a mechanism for arbitrary code execution."
}