Critical Memory Vulnerabilities in Mooncake Transfer Engine Disclosed
ID: ffd67a25-5a9c-5584-bcb5-e23fc7b4240d
STIX ID: report--ffd67a25-5a9c-5584-bcb5-e23fc7b4240d
Feed Name: ThreatCluster
Threat Score
On October 1, 2026, two critical vulnerabilities in the Mooncake transfer engine (CVE-2026-103764 and CVE-2026-103761) were disclosed; CVE-2026-103764 (CVSS 9.3) permits unauthenticated arbitrary memory read/write potentially leading to code execution, while CVE-2026-103761 allows memory exhaustion that can disrupt services—both affect versions prior to 0.3.13, have patches available, and can be reached via the TCP data and handshake RPC ports, so immediate patching and network restrictions are advised.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.