AIKIDO-2026-849339

mooncake-transfer-engine is vulnerable to Untrusted Pointer Dereference leading to Arbitrary Memory Read/Write

Untrusted Pointer Dereference leading to Arbitrary Memory Read/WriteCVE-2026-103764 Published Today

Critical Risk

This Affects:

mooncake-transfer-engine

0.3.0 - 0.3.12

Fixed in 0.3.13

Are you affected? Scan for Free

TL;DR

Mooncake transfer engine's TcpTransport server-side session handler (ServerSession in tcp_transport.cpp) parsed an inbound SessionHeader containing attacker-controlled addr, size, and opcode fields over the unauthenticated TCP data port and used them directly to perform READ or WRITE memory operations without validating that the pointer and length referred to a previously registered, bounds-checked buffer. This allowed any network client able to reach the data port to read or write arbitrary process memory, exposing KV cache contents, prompts, and secrets, or corrupting memory toward potential code execution.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and expose the Mooncake TCP transport data port to any network reachable by untrusted clients, since the server accepts unauthenticated SessionHeader messages with attacker-controlled addr and size fields used directly for memory read/write operations.