{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/moos/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moos:ui_moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-85452"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ui-moos (\u003c= 50b9c6c)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","buffer-overflow"],"_cs_type":"advisory","_cs_vendors":["MOOS"],"content_html":"\u003cp\u003eThe MOOS (Mission Oriented Operating Suite) ui-moos component, specifically versions through commit 50b9c6c, contains a critical buffer overflow vulnerability within ScopeTabPane.cpp and ScopeGrid.cpp. The vulnerability arises from the use of the sprintf function to format client and variable names into fixed 1024-byte buffers without appropriate length validation. An attacker capable of interacting with the application can supply arbitrarily long MOOS identifiers. When an operator performs actions such as selecting entries from the process list or poking variables, the application attempts to write these overly large strings into the insufficient buffers, triggering a memory corruption event. This vulnerability poses a significant risk to the integrity and availability of the MOOS environment, as successful exploitation could lead to arbitrary code execution on systems running the affected ui-moos component.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-85452 allows an attacker to achieve code execution within the context of the user running the ui-moos application. This could result in unauthorized system access, data exfiltration, or total compromise of the affected workstation. Given that MOOS is typically used in robotics, marine, and autonomous systems, the operational impact of such a compromise could involve the loss of control over autonomous vehicles or failure of critical mission software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize updating the ui-moos component to a version beyond commit 50b9c6c. Since no official patch release version is specified, verify the fix via source code analysis of the commit history to ensure the sprintf usage has been replaced with safer functions like snprintf. In environments where immediate patching is not possible, implement network segmentation and strict access controls to limit the ability of unauthorized entities to send MOOS identifier packets or interact with the ui-moos process list features.\u003c/p\u003e\n","date_modified":"2026-09-03T23:29:30Z","date_published":"2026-09-03T23:29:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-03-moos-buffer-overflow/","summary":"The ui-moos component is vulnerable to a buffer overflow in ScopeTabPane.cpp and ScopeGrid.cpp, potentially allowing arbitrary code execution when processing crafted MOOS identifiers.","title":"Buffer Overflow Vulnerability in MOOS ui-moos","url":"https://feed.craftedsignal.io/briefs/2026-09-03-moos-buffer-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moos-ivp:essential-moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-85427"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["essential-moos (\u003c= 10.0.1)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","vulnerability","cve","network-security"],"_cs_type":"advisory","_cs_vendors":["MOOS"],"content_html":"\u003cp\u003eThe MOOS-IvP open-source project essential-moos suite, specifically the pAntler component through version 10.0.1, contains a critical remote code execution vulnerability. pAntler is designed to manage and launch various MOOS processes defined within a mission file. An unauthenticated attacker capable of communicating with the MOOSDB can publish a specially crafted 'MISSION_FILE' message. The pAntler application reads the contents of this message and parses it for 'Run' entries. Due to a lack of authentication and input validation on these entries, pAntler passes the user-supplied strings directly to the execvp() system call, resulting in the execution of arbitrary programs with the privileges of the pAntler process. This vulnerability is significant for autonomous systems and research platforms that utilize the MOOS-IvP architecture, as it allows for full command execution on the host machine.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes network connectivity to the target MOOSDB port.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious MISSION_FILE message containing arbitrary commands within 'Run' entries.\u003c/li\u003e\n\u003cli\u003eAttacker publishes the crafted message to the MOOSDB via the MOOS protocol.\u003c/li\u003e\n\u003cli\u003eThe pAntler component receives the malicious MISSION_FILE message from the MOOSDB.\u003c/li\u003e\n\u003cli\u003epAntler parses the 'Run' entries within the message without validating the input.\u003c/li\u003e\n\u003cli\u003epAntler calls the execvp() system call, passing the malicious entries.\u003c/li\u003e\n\u003cli\u003eThe operating system executes the attacker-defined program on the host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to execute arbitrary programs on systems running affected versions of essential-moos. This can lead to full system compromise, loss of control over autonomous mission software, and data exfiltration. The vulnerability affects research and robotics environments utilizing the MOOS-IvP middleware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the essential-moos software to a version beyond 10.0.1 immediately, if available, or isolate MOOSDB instances from untrusted network segments.\u003c/li\u003e\n\u003cli\u003eImplement network access controls (NAC) to restrict communication with the MOOSDB port to authorized and authenticated mission components only.\u003c/li\u003e\n\u003cli\u003eAudit environments for the use of pAntler and ensure process execution policies are configured to minimize the impact of unauthorized sub-process spawning.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-03T23:27:50Z","date_published":"2026-09-03T23:25:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-moos-pantler-rce/","summary":"The pAntler component in essential-moos versions 10.0.1 and earlier allows unauthenticated attackers to achieve remote code execution by publishing a crafted MISSION_FILE message to the MOOSDB.","title":"Remote Code Execution in MOOS essential-moos pAntler","url":"https://feed.craftedsignal.io/briefs/2026-09-moos-pantler-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moos-ivp:core-moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-85440"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["core-moos (\u003c= 10.4.0)"],"_cs_severities":["critical"],"_cs_tags":["cve","authentication-bypass","middleware","denial-of-service","network-vulnerability","vulnerability","network-security","remote-access"],"_cs_type":"advisory","_cs_vendors":["MOOS-IvP","MOOS"],"content_html":"\u003cp\u003eMOOS core-moos versions up to 10.4.0 contain a critical heap-based buffer overflow vulnerability within the MOOSCommPkt packet handling logic. The issue resides in the HandShake phase, which occurs before authentication is established. An unauthenticated remote attacker can supply a negative value in the packet length field, which bypasses existing signed integer checks within the InflateTo() function. This discrepancy leads to an improper size conversion when the data is passed to the recv() function, causing a heap overflow of a four-byte buffer. Successful exploitation allows an attacker to write arbitrary data into the process memory, potentially leading to remote code execution or application crashes. Given the pre-authentication nature of this flaw, defenders should prioritize patching or restricting access to the MOOS communication ports.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a TCP/IP connection to the target host on the MOOS communication port.\u003c/li\u003e\n\u003cli\u003eAttacker initiates the HandShake phase of the communication protocol.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious packet header containing a negative integer in the packet length field.\u003c/li\u003e\n\u003cli\u003eThe victim application receives the malicious packet via the InflateTo() function.\u003c/li\u003e\n\u003cli\u003eThe vulnerability in the signed integer check allows the negative length to pass validation.\u003c/li\u003e\n\u003cli\u003eThe application performs a heap-based memory allocation based on the unchecked length.\u003c/li\u003e\n\u003cli\u003eThe recv() function processes the attacker-supplied data, resulting in a heap overflow of the internal four-byte buffer.\u003c/li\u003e\n\u003cli\u003eAttacker achieves arbitrary memory write, leading to remote code execution or process termination.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code or cause a denial-of-service condition on affected MOOS installations. This affects systems utilizing MOOS core-moos versions 10.4.0 and earlier. Organizations relying on this software for underwater vehicle communication or similar robotics research environments are at high risk if instances are exposed to untrusted networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch core-moos by upgrading to a version exceeding 10.4.0 immediately upon release of vendor updates.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, restrict access to MOOS communication ports via host-based firewalls or network access control lists to known trusted endpoints only.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for anomalous packet headers directed toward MOOS services, specifically looking for TCP streams containing negative length identifiers in the handshake phase.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-04T01:24:01Z","date_published":"2026-09-03T23:25:19Z","id":"https://feed.craftedsignal.io/briefs/2026-09-moos-heap-overflow/","summary":"A pre-authentication heap overflow vulnerability in the MOOSCommPkt packet handling of MOOS core-moos versions up to 10.4.0 allows remote unauthenticated attackers to perform arbitrary memory writes via crafted packets.","title":"CVE-2026-85440: Heap Overflow in MOOS core-moos","url":"https://feed.craftedsignal.io/briefs/2026-09-moos-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - MOOS","version":"https://jsonfeed.org/version/1.1"}