External risk intelligence

MOOS core-moos Heap Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85440

MOOS (Mission Oriented Operating Suite) is typically used for autonomous vehicle and robotics research or internal control networks. While it utilizes network communication, it is not a standard internet-facing service or web application, making direct public-internet exposure uncommon in typical real-world deployments.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the MOOS core-moos software, affecting how network packets are handled. This issue allows unauthenticated remote attackers to potentially inject arbitrary data into the system before any security checks are performed. The primary concern is confirming if this technology is in use and if it is exposed in a way that could be targeted.

Pre-authentication flaw allows remote data injection.
Leadership should monitor for custom robotics systems.
Confirm relevance and exposure of MOOS deployments.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by sending specially crafted network packets to a vulnerable system before any authentication occurs. The attack targets the packet handling mechanism, specifically how it processes packet lengths. By manipulating this length to be negative, an attacker can cause a heap overflow, potentially allowing them to write arbitrary data into memory.

No authentication or special access required.
Negative packet length declaration.
Arbitrary data write to memory.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and availability of MOOS systems by allowing remote attackers to overwrite arbitrary data in memory. This could occur during the initial handshake phase before any authentication takes place, when a negative packet length is declared. The attacker could exploit this to potentially disrupt service or manipulate system behavior.

Data or system asset at risk: MOOS system memory and control.
How exposure could happen: Declaring negative packet length during handshake.
Realistic consequence: Service disruption or unintended system behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MOOS core-moos affects systems that handle network communications, potentially impacting autonomous vehicle and robotics research or internal control networks. The first practical step is to identify all instances of MOOS core-moos within your environment, assess their network reachability and business criticality, and then determine the accountable owner for remediation. This assessment will inform the appropriate response, which may involve vendor coordination or planned maintenance.

Identify affected MOOS deployments.
Verify network exposure and criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS core-moos?

MOOS, or Mission Oriented Operating Suite, is a software framework designed to support autonomy in robotics and autonomous underwater vehicles. It provides a messaging architecture that allows independent processes to communicate over a network, serving as a core component for researchers and developers building distributed control systems for robotic platforms.

How does CVE-2026-85440 manifest as a heap overflow?

This vulnerability is classified as CWE-787, an out-of-bounds write. It occurs because the software fails to correctly validate the length of incoming data packets during the initial handshake. By sending a packet with a negative length value, an attacker can trick the system into allocating a small buffer and then copying more data into that memory than it can hold, resulting in a heap overflow.

Do I need to be logged in for an attacker to trigger this?

No. The vulnerability exists in the pre-authentication phase of the connection process. An attacker does not need credentials or prior access to the system to initiate the attack; simply sending the malformed packet during the handshake phase is sufficient to trigger the flaw.

Is my system at risk based on Halo Surface Signal?

Halo Surface Signal indicates that exploitation is considered unlikely for many users because MOOS is typically deployed within specialized internal robotics or research control networks rather than as public-facing services. While the bug itself is critical, your actual risk depends heavily on whether your specific MOOS instances are reachable from untrusted networks.

When should I begin responding to this CVE?

You should begin by performing an inventory of your environment to locate all active MOOS core-moos deployments. Once identified, evaluate the network accessibility of those systems and their criticality to your operations. Use this information to coordinate with the relevant system owners and prioritize remediation efforts, such as updating software or isolating the affected network segments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.