Mooncake transfer engine versions prior to 0.3.13 contain an untrusted pointer dereference vulnerability in the ServerSession::readHeader function. This flaw allows unauthenticated remote attackers to send crafted SessionHeader structures with arbitrary address and size values using READ or WRITE opcodes. By doing so, attackers can read or write arbitrary memory in the process, potentially disclosing sensitive KV cache data or corrupting memory to achieve code execution.

The vulnerability enables unauthenticated remote attackers to read and write arbitrary process memory, which can lead to disclosure of sensitive information such as KV cache contents, prompts, and secrets. Additionally, memory corruption could be leveraged to execute arbitrary code within the affected process. The CVSS 4.0 score of 9.3 reflects the critical severity and the high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

A fix is available in Mooncake version 0.3.13. Users should upgrade to version 0.3.13 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary once the update is applied.