Description

MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-03T23:17:25.803Z",
  "pubdate": "2026-09-03T23:17:25.803Z",
  "executiveSummary": "The MOOS-IvP core-moos library, specifically versions through 10.4.0, is susceptible to a buffer over-read vulnerability within the CMOOSCommPkt deserialization logic. This flaw allows a remote, unauthenticated attacker to trigger out-of-bounds memory access by providing a malformed, four-byte TCP packet.\nThe vulnerability resides in the core communication parsing routines of the MOOSDB process. By exploiting this flaw, an attacker can read sensitive data from the heap or stack, potentially leading to information disclosure or the leakage of memory addresses that could facilitate further exploitation, such as bypassing security controls like ASLR.\nExploitation requires the ability to establish a TCP connection to the MOOSDB network service. Because the vulnerability manifests during the packet deserialization phase, the attack occurs prior to any authentication or authorization checks. Consequently, the flaw presents a significant risk to the confidentiality of the MOOSDB memory space in network-exposed environments.",
  "technicalDetails": "The vulnerability is situated within the CMOOSCommPkt class, which is responsible for handling the serialization and deserialization of communication packets within the MOOS (Mission Oriented Operating Suite) framework. The root cause is an improper bounds check or assumption regarding packet length during the deserialization of incoming TCP streams received by the MOOSDB process.\nSpecifically, the implementation fails to safely handle a packet payload of exactly four bytes. When the parsing routine encounters this short packet length, the logic attempts to access memory offsets or members that exist beyond the allocated bounds of the buffer provided for that specific packet. This results in an out-of-bounds memory read (buffer over-read) operation.\nThe attack flow begins when a remote client initiates a standard TCP connection to the port utilized by MOOSDB. Upon connection establishment, the attacker crafts a malicious packet payload of four bytes. The MOOSDB process reads this packet from the socket and passes it to the CMOOSCommPkt deserialization functions. Because the internal logic does not sufficiently validate the relationship between the packet length field and the actual buffer size, the function accesses memory addresses adjacent to the buffer allocated for the incoming message.\nBecause this process occurs at the transport layer before the MOOS-specific authentication handshake is initiated or finalized, the attacker maintains an unprivileged, unauthenticated posture throughout the exploitation attempt. The impact of this over-read is twofold: first, it may allow the attacker to extract sensitive data present in the adjacent heap or stack memory, including session keys, credentials, or internal process configuration data. Second, repeated triggering of this flaw could induce a process crash (Denial of Service) if the over-read access violates memory protection boundaries, triggering a segmentation fault or a memory access violation exception.\nThe vulnerability is present in versions up to and including 10.4.0. The susceptibility of the system is tied directly to the core-moos component and its handling of incoming network data via the underlying TCP socket implementation. Due to the nature of the vulnerability occurring during the early stages of packet parsing, it is difficult to mitigate via application-level authentication protocols, as the memory access is triggered before such mechanisms are reached."
}