CVE-2026-103764: Mooncake Memory Access Flaw

What Happened, in Brief

CVE-2026-103764 is a critical Mooncake vulnerability in the transfer engine’s TCP transport implementation. A remote attacker who can reach the TCP data port can submit a crafted SessionHeader containing attacker-controlled address and size values. The vulnerable code can then use those values in memory-read or memory-write operations.

The impact can include disclosure of KV-cache contents, prompts, secrets, and other process data. The write capability can corrupt process memory and may provide a path toward arbitrary code execution, although the available record does not establish a complete exploit chain or confirm code execution in a deployed environment.

Exposure is the immediate operational question. The available record does not establish whether the affected TCP port is exposed by default, so administrators must inspect their own deployment configuration. Any instance reachable from an untrusted network should be treated as high risk until upgraded or isolated.

Analyst’s Take: The first step is to identify every instance running below 0.3.13 and determine whether its configured TCP data port is reachable from an untrusted network. The absence of a confirmed public PoC or KEV listing lowers neither the urgency of patching exposed services nor the need to investigate suspicious access.

What’s the Root Cause?

The root cause is an untrusted pointer dereference in ServerSession::readHeader within the TCP transport implementation. The cited vulnerable location is in mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp, around line 209.

The server accepts attacker-controlled addr and size fields from a session header and uses them with READ or WRITE operations without sufficient validation. In practical terms, the transport protocol allows a remote client to influence which process-memory location is accessed and how much data is handled.

This is more serious than a conventional information disclosure bug because the same design weakness supports both reads and writes. Reads can expose sensitive model-serving data, while writes can destabilize the process or corrupt control data. The available sources describe potential progression to code execution, but they do not provide a confirmed exploit chain or public weaponized payload.

Technical Notes

The vulnerable behavior is associated with crafted SessionHeader data and READ or WRITE opcodes. Defenders should not attempt to reproduce the memory-access behavior against production systems. For source review, compare the vulnerable revision with the upstream fixing commit:

Vulnerable file:
mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp

Fix commit:
a2933849417259e562fc9cbad63c618d464dfb2d

Who Needs to Act?

Organizations running the Mooncake transfer engine need to act if the deployed version is earlier than 0.3.13. The affected range is stated as all versions before 0.3.13; no narrower package-specific range was provided in the available advisory data.

This includes source builds, containers, virtual machines, and application images that bundle an older Mooncake transfer engine. Inventory should cover inference infrastructure, KV-cache services, development clusters, and temporary or autoscaled workers. A repository version alone is not sufficient evidence that every deployed binary is fixed.

The fixed release is Mooncake v0.3.13. The available information does not identify a distribution package name, operating-system package version, or separate backported patch. If a vendor or platform provider packages Mooncake, confirm that its build incorporates the upstream fix before treating the deployment as remediated.

Organizations reviewing their broader detection coverage can also consult this intrusion detection system glossary for terminology used in network monitoring and alert triage.

Why This CVSS Score?

The CVSS base score is 9.8, Critical. The score is consistent with a remotely reachable service that does not require authentication and permits high-impact memory access. The vulnerability can affect confidentiality through disclosure of KV-cache contents, prompts, secrets, and other process memory.

Integrity impact is also significant because the attacker can issue memory-write operations. Availability may be affected through memory corruption or process crashes. The disclosed behavior also creates the potential for arbitrary code execution, although that outcome is described as a possibility rather than a confirmed result of a complete exploit.

The exact CVSS vector string was not included in the retrieved NVD record. The precise component values should not be reconstructed or presented as authoritative. The available evidence supports remote access, no stated authentication requirement, and high confidentiality, integrity, and availability consequences, but defenders should retrieve the current authoritative NVD record if exact vector components are required for risk calculations.

A 9.8 score does not mean every deployment is equally exposed. Network reachability remains a crucial environmental factor. A transport port restricted to a private, allowlisted network has a different practical exposure profile from an instance reachable from the public internet, but neither should remain unpatched.

Has It Been Exploited?

No confirmed in-the-wild exploitation was identified in the retrieved NVD, CISA KEV, GitHub, or related research results. CVE-2026-103764 was not present in the CISA Known Exploited Vulnerabilities catalog at the time of assessment. There is no CISA date-added value, remediation due date, required-action entry, or ransomware-campaign designation for this CVE.

No confirmed public standalone exploit or proof-of-concept repository was identified. The public technical material includes the vulnerable source location, Mooncake issue #4441, the fixing commit, and the v0.3.13 release. Those references may reduce the effort required for vulnerability research, but they are not evidence of a working public exploit.

The absence of a KEV listing or confirmed PoC is not evidence that exploitation is impossible. An attacker with network access may be able to develop a private exploit from the source and patch diff. Treat an exposed service as urgent even though active exploitation was not confirmed.

How Do I Know If I’m Hit?

Start by determining whether any Mooncake transfer engine instance is running a version below 0.3.13. Check source checkouts, container manifests, image build records, package metadata, and the executable actually running on each host. Do not rely only on a central repository branch or an application’s reported version if binaries are copied into images during a separate build process.

Next, identify the TCP transport data port and map its reachability. Review host firewalls, security groups, load balancers, Kubernetes Services, network policies, and cloud exposure. The available record does not specify a universal port number, so use the port configured by each deployment rather than assuming a default.

There is no documented byte-level network signature in the available sources. Look for unexpected connections to the configured transport port, especially from untrusted networks, followed by malformed sessions, repeated connection attempts, unusual READ or WRITE activity, process crashes, or unexplained changes in model-serving behavior. Successful memory disclosure may not produce a clear application error, so review network telemetry and process integrity.

If an investigation identifies exposed credentials or secrets, rotate them through an approved secrets-management process. A business password manager such as 1Password may help teams organize and securely share replacement credentials, but it does not replace incident response or access-control remediation.

Technical Notes

Replace <MOONCAKE_TCP_PORT> with the configured data-port number. A basic Zeek review can identify clients reaching the service:

event connection_state_remove(c: connection)
{
    if ( c$id$resp_p == <MOONCAKE_TCP_PORT>/tcp )
        print fmt("Mooncake transport connection: %s -> %s",
                  c$id$orig_h, c$id$resp_h);
}

A SIEM query can provide an initial triage view from firewall or flow logs:

destination_port=<MOONCAKE_TCP_PORT>
| stats count min(_time) as first_seen max(_time) as last_seen
  by source_ip destination_ip action
| sort - count

This is an exposure and access query, not a confirmed exploit detector. Since no authoritative payload signature or application log pattern was provided, investigate the source hosts, session errors, crashes, memory-integrity alerts, and unusual outbound activity associated with suspicious connections.

Teams that automate alert handling may also benefit from reviewing SOAR platforms compared for 2026 when evaluating response orchestration. Automation should supplement, not replace, analyst validation for suspected memory-access activity.

What Do I Do About It?

Upgrade every affected Mooncake transfer engine deployment to 0.3.13 or later. The upstream fixed release is available as v0.3.13, and the associated fix commit is:

https://github.com/kvcache-ai/Mooncake/commit/a2933849417259e562fc9cbad63c618d464dfb2d

For a source checkout, the version-selection step can be performed with:

git fetch --tags origin
git checkout v0.3.13

Use the project’s documented build and deployment process after selecting the fixed tag. Rebuild containers and restart the affected service; updating a source tree without replacing the running binary does not remediate the vulnerability. Verify that the resulting executable or image is based on v0.3.13 or later.

Until the upgrade is complete, restrict the TCP transport data port to trusted Mooncake peers and management networks. Do not expose it directly to the internet. If the service cannot be isolated, stop or disable the affected listener where operationally feasible, recognizing that this may interrupt transfers or inference workloads.

Technical Notes

A temporary host-level firewall rule can restrict the port to a trusted subnet. Replace the placeholders with deployment-specific values and validate the rule before applying it:

sudo nft add rule inet filter input \
  tcp dport <MOONCAKE_TCP_PORT> ip saddr != <TRUSTED_CIDR> drop

Network controls are a workaround, not a patch. After upgrading, confirm that all nodes, containers, autoscaling templates, and bundled images use the fixed release. If an affected service was reachable by an untrusted party, investigate for memory disclosure and rotate exposed secrets, credentials, tokens, or other sensitive material as appropriate.

Where This Comes From

The primary vulnerability record is the National Vulnerability Database entry for CVE-2026-103764:

• NVD: CVE-2026-103764

The Mooncake project and remediation references provide the affected source context and fixed release:

• Mooncake GitHub repository
• Cited vulnerable tcp_transport.cpp location
• Upstream fixing commit
• Mooncake issue #4441
• Mooncake v0.3.13 release

CISA’s catalog is useful for tracking confirmed exploitation status:

• CISA Known Exploited Vulnerabilities Catalog

At the assessment date, CVE-2026-103764 was not listed in CISA KEV, and no confirmed public PoC or in-the-wild exploitation was established. Those findings should be revisited as new intelligence becomes available. For now, identify exposed deployments, restrict the configured transport port, and upgrade every affected instance to 0.3.13 or later.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.