Description

MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T23:17:25.330Z",
  "pubdate": "2026-09-03T23:17:25.330Z",
  "executiveSummary": "The MOOS ui-moos component is affected by multiple buffer overflow vulnerabilities due to improper handling of user-supplied data. The vulnerability exists within the application's interface handling logic, specifically when processing client and variable names.\nBy submitting maliciously crafted, oversized MOOS identifiers, an attacker can trigger a heap or stack-based buffer overflow. This flaw allows for the corruption of adjacent memory, potentially leading to arbitrary code execution or application crashes.\nThe vulnerability affects ui-moos versions up to and including commit 50b9c6c. The risk is significant as successful exploitation grants an attacker the ability to execute code with the privileges of the MOOS application instance. No authentication is explicitly required if an attacker can interface with the MOOS communication infrastructure or provide input that reaches the vulnerable GUI components.\nThis issue stems from the use of unsafe string formatting functions and highlights a critical need for input validation and the transition to safer, bounds-checked string manipulation routines within the affected codebase.",
  "technicalDetails": "The vulnerability is localized within the UI processing logic of MOOS, specifically in the ScopeTabPane.cpp and ScopeGrid.cpp files. The root cause is the usage of the unsafe 'sprintf' function to format string data into static 1024-byte character buffers.\nIn the MOOS architecture, 'sprintf' is utilized to format client identifiers and MOOS variable names for display or internal tracking purposes. These functions lack necessary length validation, assuming that the provided input strings will never exceed the pre-allocated 1024-byte limit. Because the application logic does not sanitize or truncate the input before formatting, providing an overly long string results in a buffer overflow.\nThe attack flow initiates when an operator or a connected process triggers the UI update mechanisms, such as selecting a process list entry or initiating a 'poke' operation on a variable. An attacker capable of influencing the MOOS database content—for example, by registering as a client with an arbitrarily long name or publishing a variable with an extreme identifier—can force the vulnerable files to perform an unsafe memory copy operation.\nWhen the memory is copied to the destination buffer, the lack of bounds checking causes the supplied input to exceed the 1024-byte capacity. This overwrites adjacent memory segments, including return addresses, function pointers, or critical application variables stored in the vicinity of the buffer. By precisely crafting the overflow payload, an attacker can redirect the execution flow to malicious shellcode or manipulate application state control pointers, thereby facilitating arbitrary code execution.\nThe exploitation process is straightforward: first, the attacker injects an abnormally long string into the MOOS environment via standard MOOS communication protocols. Second, the attacker interacts with the ui-moos interface in a way that forces the UI to render the malicious string. Third, the vulnerability is triggered in either ScopeTabPane.cpp or ScopeGrid.cpp during the 'sprintf' call, resulting in memory corruption and subsequent control flow hijacking. The impact of this exploit is limited to the security context of the user running the MOOS GUI, though it poses a severe threat to any workstation or control system relying on ui-moos for monitoring autonomous platforms."
}