CVE-2026-103764CWE-822

CVE-2026-103764

Critical · published October 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00636 · 49.9th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-10-02T04:16Z
References (7)
https://github.com/kvcache-ai/Mooncake · [email protected]https://github.com/kvcache-ai/Mooncake/blob/6041a609a8c3af35e778f70db344f145c2914980/mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp#L209 · [email protected]https://github.com/kvcache-ai/Mooncake/commit/a2933849417259e562fc9cbad63c618d464dfb2d · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4441 · [email protected]https://github.com/kvcache-ai/Mooncake/releases/tag/v0.3.13 · [email protected]https://www.vulncheck.com/advisories/mooncake-transfer-engine-before-0.3.13-unauthenticated-arbitrary-memory-read-write-via-tcp-transport · [email protected]https://github.com/kvcache-ai/Mooncake/issues/4441 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 01 OCT 23:19Z
    Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
    cvelistv5