Read the docs
TI-2023-22890 Aliases CVE-2023-42799

Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString`

Priority HIGH 73CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01881 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed moonlight-common-c (moonlight-stream): 02b7742

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
moonlight-streammoonlight-common-c50c0a51 to before 02b774202b7742Patch availableCNA
  • moonlight-common-c Vendormoonlight-stream Affected 50c0a51 to before 02b7742 Fixed in 02b7742 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:*2022-11-04 to before 2023-10-06Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:*8.4.0 – 8.5.0Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:*8.4.0 – 8.5.0Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:*10.10 – 11.0Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:*0.10.22Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:*2.6.0Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:*1.12.0 – 1.14.40Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:*1.5.4 – 1.5.27Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:*0.13 – 0.13.3Vulnerablemoonlight-stream
cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:*0.9.2 – 0.9.3Vulnerablemoonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:* Versions 2022-11-04 to before 2023-10-06 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:* Versions 8.4.0 – 8.5.0 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:* Versions 8.4.0 – 8.5.0 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:* Versions 10.10 – 11.0 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:* Versions 0.10.22 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:* Versions 1.12.0 – 1.14.40 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:* Versions 1.5.4 – 1.5.27 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:* Versions 0.13 – 0.13.3 Vulnerable ·moonlight-stream
  • cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:* Versions 0.9.2 – 0.9.3 Vulnerable ·moonlight-stream

Remediation

  • Fix · CNA moonlight-common-c (moonlight-stream) Fixed in 02b7742

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42799

References

Exploit 1

Patch 2

  • TI-2023-22891 Buffer overflow due to use of `strcpy` in `performRtspHandshake` CVSS 3.1HIGH 8.8
  • TI-2020-08898 Man-in-the-middle attack in Moonlight iOS/tvOS CVSS 3.1HIGH 8.2
  • TI-2023-22892 Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString` CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences