CVE-2026-103764

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.13

Description An untrusted pointer dereference exists in the readHeader function of ServerSession. This allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. By sending a crafted SessionHeader containing arbitrary addr and size values using READ or WRITE opcodes, an attacker can disclose KV cache contents, prompts, and secrets, or corrupt memory to achieve code execution.

Recommendations Update Mooncake transfer engine to version 0.3.13 or later.