CVE-2026-103764

{
  "etk_id": "ETK-2026-290",
  "cve_id": "CVE-2026-103764",
  "display_id": "CVE-2026-103764",
  "ghsa_id": "GHSA-mp8g-r7h2-5x36",
  "euvd_id": "EUVD-2026-91136",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe pointer dereference in Mooncake transfer engine",
  "summary": "Mooncake versions before 0.3.13 are affected in transfer-engine session header processing. An unauthenticated remote attacker able to reach the TCP data port may read or modify process memory, exposing cached information or potentially taking control of the process.",
  "mitigation": "Upgrade Mooncake to version 0.3.13 or later. Until upgrades are complete, block untrusted network access to the TCP data port.",
  "vendor": "kvcache-ai",
  "product": "Mooncake",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.3.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.3.13"
      ],
      "package_name": "Mooncake",
      "purl": null
    }
  ],
  "cwes": [
    822
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0064,
  "epss_percentile": 0.4958,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 138.47359311666668,
  "t0_at": "2026-10-01T23:19:57.849000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T23:19:57.849000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T23:19:57.849000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103764"
    }
  }
}