# CVE-2026-85441: MOOS core-moos deserialization DoS in CMOOSMsg

Source: https://junglewise.ai/threats/cve-2026-85441-moos-core-moos-deserialization-dos-in-cmoosmsg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85441 · Severity: high · CVSS 7.5 · Published 2026-09-03

MOOS is a lightweight middleware platform used for real-time communication in robotics and autonomous systems. A vulnerability in the message deserialization logic allows unauthenticated attackers to crash the MOOSDB (the central message broker) by sending a specially crafted network message with a malformed string length field, causing an unhandled exception and service outage.

Technologies: [MOOS Core-Moos](https://junglewise.ai/threats/technologies/core-moos). Vendors: [MOOS](https://junglewise.ai/threats/vendors/moos).

## Quick answers

**Is CVE-2026-85441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85441 being exploited in the wild.

**How severe is CVE-2026-85441?** High severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** MOOS Core-Moos through 10.4.0.

**Is there a fix for CVE-2026-85441?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85441 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85441?** Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a deserialization flaw in CMOOSMsg::operator>> that fails to validate that serialized string lengths are non-negative. An unauthenticated attacker can send a crafted network packet to the MOOSDB port with a negative length value in a string field. This causes the deserialization routine to throw an unhandled exception, terminating the MOOSDB process. The attack requires network access to the MOOSDB port but no authentication; it causes a denial-of-service condition affecting all MOOS clients dependent on the database service.

## Affected products

- MOOS core-moos through 10.4.0

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/themoos/core-moos](https://github.com/themoos/core-moos)
- [https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSMsg.cpp](https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSMsg.cpp)

## Related threats

- [MOOS core-moos buffer over-read in CMOOSCommPkt deserialization](https://junglewise.ai/threats/cve-2026-85455-moos-core-moos-buffer-over-read-in-cmooscommpkt-deserialization)
- [MOOS core-moos buffer overflow in CMOOSSerialPort](https://junglewise.ai/threats/cve-2026-85454-moos-core-moos-buffer-overflow-in-cmoosserialport)
- [MOOS core-moos DOM-based XSS in HTTP MOOSDB interface](https://junglewise.ai/threats/cve-2026-85453-moos-core-moos-dom-based-xss-in-http-moosdb-interface)
- [MOOS core-moos remote process termination via hardcoded multicast passphrase](https://junglewise.ai/threats/cve-2026-85451-moos-core-moos-remote-process-termination-via-hardcoded-multicast)
- [MOOS core-moos denial of service in MOOSDB HTTP server](https://junglewise.ai/threats/cve-2026-85450-moos-core-moos-denial-of-service-in-moosdb-http-server)