CVE-2026-85440: Themoos Core-Moos

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

Affected products

• Themoos Core-Moos: up to and including 10.4.0

Published 2026-09-03. Last modified 2026-09-08.