CVE-2026-103764
Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
kvcache-ai Mooncake
CVSS
9.3CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.64%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.3.13MooncakeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
Text from CVE List
Affected versions 1
- Mooncakeaffected: all versions before 0.3.13CVE List
References 6
- github.com/kvcache-ai/Mooncake/commit/a2933849417259e562fc9cbad63c618d464dfb2dFixvia CVE List
- github.com/kvcache-ai/Mooncake/releases/tag/v0.3.13Fixvia CVE List
- vulncheck.com/advisories/mooncake-transfer-engine-before-0.3.13-unauthenticated-arbitrary-memory-read-write-via-tcp-transportAdvisoryvia CVE List
- github.com/kvcache-ai/Mooncake/issues/4441Exploitvia CVE List
- github.com/kvcache-ai/Mooncake/blob/6041a609a8c3af35e778f70db344f145c2914980/mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp#L209Referencevia CVE List
- github.com/kvcache-ai/MooncakeReferencevia CVE List