CVE-2026-85455

MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.

• CWE-125

• https://github.com/themoos/core-moosProduct
• https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSCommPkt.cpp#L228Issue Tracking, Patch
• https://github.com/themoos/core-moos/commit/d30c14585753f9ae39749d9628ed15c8383f0568Issue Tracking, Patch
• https://github.com/themoos/core-moos/pull/75Issue Tracking, Patch
• https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-out-of-bounds-read-via-short-packetThird Party Advisory

Published

Sep 3, 2026

Last Modified

Oct 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8545Object corruption in Compositing in Google Chrome prior to 1…3.1
• CVE-2026-85450MOOS core-moos through 10.4.0 contains a denial of service v…7.5
• CVE-2026-85451MOOS core-moos through 10.4.0 contains a remote process term…7.1
• CVE-2026-85452MOOS ui-moos through 50b9c6c contains a buffer overflow vuln…8.8
• CVE-2026-85453MOOS core-moos through 10.4.0 fails to escape database conte…6.1
• CVE-2026-85454MOOS core-moos through 10.4.0 contains a buffer overflow vul…6.1
• CVE-2026-85456MOOS-IvP through 24.8.1 fails to properly validate variable …5.5
• CVE-2026-85457IBM Planning Analytics 2.0, and 2.1 could allow a remote aut…8.1
• CVE-2026-85458Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a…2.1
• CVE-2026-8546Out of bounds read in GPU in Google Chrome on Mac and Window…5.3
• CVE-2026-85469A flaw was found in quay-builder-qemu. A remote attacker cou…8
• CVE-2026-8547Insufficient policy enforcement in Passwords in Google Chrom…7.5