CVE-2026-85436— MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length
Quick assessment
Affected
themoos essential-moos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MOOS 在 essential-moos 版本（从早期版本到 10.0.1）中存在一个缓冲区溢出漏洞。该漏洞位于 函数中，允许远程攻击者通过发送具有负数声明长度的 UDP 数据报来破坏堆内存。攻击者可以向配置的 UDP 监听端口发送精心构造的 UDP 数据包，从而触发一个过大的 操作，导致写入超出目标缓冲区边界，造成堆内存损坏和拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85436
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length
Source: CVE Program / CVE List V5
Vulnerability Description
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themoos | essential-moos | 0 ~ 10.0.1 | - |
|
II. Public POCs for CVE-2026-85436
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85436
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85436 (2)
Vendor Advisories for CVE-2026-85436 (1)
Security Blog Posts for CVE-2026-85436 (1)
Other References for CVE-2026-85436 (1)
Same Patch Batch · themoos · 2026-09-03 · 18 CVEs total
| CVE-2026-85440 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet |
| CVE-2026-85433 | 9.8 CRITICAL | MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration |
| CVE-2026-85424 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_ |
| CVE-2026-85428 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write |
| CVE-2026-85430 | 9.1 CRITICAL | MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing |
| CVE-2026-85452 | 8.8 HIGH | MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers |
| CVE-2026-85455 | 8.2 HIGH | MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet |
| CVE-2026-85432 | 8.2 HIGH | MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity |
| CVE-2026-85427 | 8.1 HIGH | MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSI |
| CVE-2026-85441 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Leng |
| CVE-2026-85443 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service |
| CVE-2026-85431 | 7.5 HIGH | MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection |
| CVE-2026-85450 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion |
| CVE-2026-85442 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation |
| CVE-2026-85451 | 7.1 HIGH | MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphra |
| CVE-2026-85454 | 6.1 MEDIUM | MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling |
| CVE-2026-85453 | 6.1 MEDIUM | MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting |
IV. Related Vulnerabilities
Same product: essential-moos
-
CVE-2026-85433
MOOS essential-moos through 10.0.1 pShare Unauthorized Runti -
CVE-2026-85431
MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticat -
CVE-2026-85430
MOOS essential-moos through 10.0.1 pShare Unauthenticated UD -
CVE-2026-85427
MOOS essential-moos through 10.0.1 pAntler Remote Code Execu
Same vendor: themoos
-
CVE-2026-85455
MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via -
CVE-2026-85454
MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in -
CVE-2026-85453
MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross -
CVE-2026-85452
MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MO -
CVE-2026-85451
MOOS core-moos through 10.4.0 Remote Process Termination via
Same weakness: CWE-191
-
CVE-2026-9624
RSLinx Classic® - Multiple Vulnerabilities -
CVE-2026-9622
RSLinx Classic® - Multiple Vulnerabilities -
CVE-2026-82480
NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLe -
CVE-2026-54754
Klever-Go: Marketplace settlement mints KLV when referral % -
CVE-2026-82250
gitoxide gix-packetline before 0.21.5 Denial of Service
V. Comments for CVE-2026-85436
No comments yet