CVE-2026-85441: Signed to Unsigned Conversion Error in themoos core-moos
Description
MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.
CVSS v4.0
Score 8.7high
Affected software
themoos
core-moos
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Themoos core-moos versions through 10.4.0 contain a vulnerability in the deserialization logic of CMOOSMsg::operator>>. The software fails to check that serialized string lengths are non-negative before processing. An attacker can exploit this by sending a malicious message with a negative length value to the MOOSDB port, triggering an unhandled exception that crashes the database process. This denial-of-service condition requires no authentication or user interaction and has a CVSS 4.0 base score of 8.7, indicating high severity.
Potential Impact
An unauthenticated attacker can cause a denial-of-service by crashing the MOOS database process through sending a specially crafted message with a negative length value. This disrupts availability of the MOOSDB service. There is no indication of code execution or data disclosure from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting access to the MOOSDB port to trusted sources to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-03T19:50:58.148Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a99fa4aacd9273b4994b232
Added to database: 09/03/2026, 22:52:58 UTC
Last enriched: 09/07/2026, 12:24:42 UTC
Last updated: 10/18/2026, 18:48:24 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.