by Kastro
Paper/Archive/CVE-2026-103764

CVE-2026-103764

kvcache-ai Mooncake — Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.0.570 × 2011.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

Affected

ProductAffectedFixed inSource
Mooncake< 0.3.130.3.13CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/kvcache-ai/Mooncake/issues/4441patchgithub.com/kvcache-ai/Mooncake/commit/a2933849417259e562fc9cbad63c618d464dfb2drefgithub.com/kvcache-ai/Mooncake/releases/tag/v0.3.13writeupgithub.com/kvcache-ai/Mooncake/blob/6041a609a8c3af35e778f70db344f145c2914980/mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp#L209refgithub.com/kvcache-ai/Mooncakewriteupvulncheck.com/advisories/mooncake-transfer-engine-before-0.3.13-unauthenticated-arbitrary-memory-read-write-via-tcp-transport