CVE-2026-103764Published
Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-103764 · Microsoft / collected KEV context
cve-program · CVE-2026-103764
- https://github.com/kvcache-ai/Mooncake/issues/4441
- https://github.com/kvcache-ai/Mooncake/commit/a2933849417259e562fc9cbad63c618d464dfb2d
- https://github.com/kvcache-ai/Mooncake/releases/tag/v0.3.13
- https://github.com/kvcache-ai/Mooncake/blob/6041a609a8c3af35e778f70db344f145c2914980/mooncake-transfer-engine/src/transport/tcp_transport/tcp_transport.cpp#L209
- https://github.com/kvcache-ai/Mooncake
- https://www.vulncheck.com/advisories/mooncake-transfer-engine-before-0.3.13-unauthenticated-arbitrary-memory-read-write-via-tcp-transport
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.