Description

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-03T23:17:25.660Z",
  "pubdate": "2026-09-03T23:17:25.660Z",
  "executiveSummary": "MOOS core-moos versions up to and including 10.4.0 contain a critical buffer overflow vulnerability located within the CMOOSSerialPort::GetTelegram() function.\nThis vulnerability is classified as an off-by-one memory corruption error, where a NUL terminator is erroneously written one byte beyond the boundaries of a fixed-size stack buffer.\nThe flaw can be exploited by an attacker who has control over the serial input line, enabling the delivery of a specifically crafted, full-length telegram.\nSuccessful exploitation results in stack memory corruption, which may facilitate arbitrary code execution in the context of the affected application.\nGiven that the vulnerability resides in the serial data processing logic, the primary attack vector is physical or logical access to the serial interface.\nThe risk implication is high, as memory corruption vulnerabilities often lead to system compromise, service disruption, or unauthorized access.\nExploitation requires the ability to supply serial data that fills the buffer completely, triggering the out-of-bounds write during the termination process.\nThis vulnerability represents a significant security oversight in the handling of serial input streams and requires immediate attention for remediation.",
  "technicalDetails": "The vulnerability originates in the CMOOSSerialPort::GetTelegram() method within the MOOS core-moos library. This function is responsible for parsing and delimiting incoming serial communication packets, referred to as telegrams.\nThe root cause is an off-by-one error occurring during the string termination process. When a serial telegram exactly matches the capacity of the destination stack buffer, the implementation attempts to append a NUL terminator (\\0) to the end of the data. Because the buffer is already filled to its maximum length, the NUL byte is written to the memory address immediately adjacent to the buffer on the stack.\nThe exploitation flow begins with an attacker who has access to the serial interface used by the MOOS software. The attacker transmits a data stream designed to fill the designated stack buffer completely. When the GetTelegram() function processes this data, it reaches the termination logic and performs an out-of-bounds write operation.\nBy writing a NUL byte to the memory address immediately following the buffer, the attacker can overwrite sensitive stack data. Depending on the compiler's stack layout and the specific architecture of the target system, this write can overwrite critical control structures, such as saved frame pointers, function return addresses, or local variables that control program flow.\nIf the overwritten data influences the execution path, an attacker can redirect program flow to arbitrary memory locations. This could lead to a control-flow hijack, allowing for the execution of malicious code or the bypassing of security restrictions. The impact is essentially limited by the attacker's ability to manipulate the stack contents through precise timing and control of the serial input stream.\nThe vulnerability affects all versions of core-moos up to and including 10.4.0. Since this is a low-level memory corruption issue, it does not require authentication in the traditional sense, as it targets the data processing logic of the serial driver itself. The exposure is limited to systems where the serial port is accessible to external entities or untrusted hardware inputs. Post-exploitation, an attacker can gain the same privileges as the user or service running the affected MOOS process, potentially leading to full system compromise depending on the process's permission level."
}