CVE-2026-85433

MOOS essential-moos pShare component (versions through 10.0.1 ) fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages with cmd=output or cmd=input to open new listeners on arbitrary addre...

CVE-2026-85431

MOOS essential-moos (through version 10.0.1 ) is vulnerable to an unauthenticated UDP packet injection in pMOOSBridge when configured with UDPListen. An attacker can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community, with spoofed source an...

CVE-2026-85430

MOOS essential-moos (through version 10.0.1) contains an authentication bypass in the pShare component, which accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. An unauthenticated network attacker can inject crafted messages into the local MOOS c...

CVE-2026-85427

pAntler in MOOS essential-moos through 10.0.1 is vulnerable to remote code execution. An unauthenticated attacker can publish a crafted MISSION_FILE message to the MOOSDB containing malicious Run entries, which pAntler parses and executes via execvp() without any authentication validation. The vu...

CVE-2026-85436

MOOS essential-moos through version 10.0.1 is affected by a buffer overflow in CMOOSUDPLink::ReadPktFromArray() within the pMOOSBridge component. The root cause is that negative declared lengths in received UDP datagrams trigger an oversized memcpy operation, writing past the destination buffer a...