Is CVE-2026-85440 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85440?

CVE-2026-85440 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-85440

Description

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.