CyberRota Analysis
AI-GeneratedThe Mooncake transfer engine prior to version 0.3.13 is vulnerable due to an untrusted pointer dereference in the ServerSession::readHeader function, allowing unauthenticated attackers to manipulate process memory through crafted TCP packets. This critical vulnerability can lead to unauthorized disclosure of sensitive data, including KV cache contents and secrets, as well as potential memory corruption that may facilitate code execution. Organizations using this software should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.