CVE-2026-85454 MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling

Medium 5.2 Published 3 Sep 2026 Updated 8 Sep 2026

Attackers controlling the serial line can trigger an off-by-one buffer overflow in MOOS core-moos, potentially enabling code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-85454?

CVE-2026-85454 is a medium-severity memory corruption vulnerability in themoos core-moos, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.

Weakness: CWE-193

Which versions are affected by CVE-2026-85454?

It affects 1 product.

Products include Themoos Core-Moos.

How do I fix CVE-2026-85454?

No fix has been published for CVE-2026-85454 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-85454 being exploited?

There is no known exploitation of CVE-2026-85454 in the wild and no public exploit code.

Sources

Also known as GHSA-793h-4m99-4gx3.