CVE-2026-85452: Out-of-bounds Write in themoos ui-moos

The vulnerability in themoos ui-moos arises from unsafe use of sprintf to format client and variable names into fixed-size 1024-byte buffers without validating input length. This buffer overflow can be triggered by supplying excessively long MOOS identifiers during user interactions such as selecting process list entries or poking variables. The flaw exists in the source files ScopeTabPane.cpp and ScopeGrid.cpp. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary code execution due to buffer overflow, compromising confidentiality, integrity, and availability of the affected system. The vulnerability can be triggered remotely without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid interacting with untrusted MOOS identifiers or process list entries in ui-moos. Monitor vendor channels for updates and apply official patches once released.