CVE-2026-103764

Summary

The flaw in Mooncake transfer engine before 0.3.13 allows unauthenticated attackers to read and write arbitrary process memory, potentially disclosing sensitive information or leading to code execution.

Exploitability

Exploitation is relatively straightforward as it requires sending a crafted SessionHeader with specific opcodes. The attacker must have access to the TCP transport data port.

Blast radius

If exploited, the impact could be severe, including the disclosure of sensitive KV cache contents, prompts, and secrets, or even code execution.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Mooncake transfer engine 0.3.13 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.