Read the docs
TI-2026-58650 Aliases CVE-2026-85452GHSA-44c2-mhg8-554v

MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers

Priority MEDIUM 41CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00693 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85452
  2. 2026-10-03 Alias added: GHSA-44c2-mhg8-554v

References

Patch 2

Other 2

  • TI-2026-58653 MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet CVSS 4.0HIGH 8.8
  • TI-2026-58638 MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length CVSS 4.0CRITICAL 9.3
  • TI-2026-58629 MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection CVSS 4.0HIGH 8.7
  • TI-2026-58626 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write CVSS 4.0CRITICAL 9.3
  • TI-2026-58622 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR CVSS 4.0CRITICAL 9.3
  • TI-2026-58631 MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration CVSS 4.0CRITICAL 9.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences