Buffer overflow due to use of `strcpy` in `performRtspHandshake`
Priority HIGH 73CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01881 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed moonlight-common-c (moonlight-stream): 24750d4b748fefa03d09fcfd6d45056faca354e0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moonlight-stream | moonlight-common-c | 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 to before 24750d4b748fefa03d09fcfd6d45056faca354e0 | 24750d4b748fefa03d09fcfd6d45056faca354e0 | Patch available | CNA |
- moonlight-common-c Vendormoonlight-stream Affected 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 to before 24750d4b748fefa03d09fcfd6d45056faca354e0 Fixed in 24750d4b748fefa03d09fcfd6d45056faca354e0 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:* | 2022-11-04 to before 2023-10-06 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:* | 8.4.0 – 8.5.0 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:* | 8.4.0 – 8.5.0 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:* | 10.10 – 11.0 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:* | 0.10.22 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:* | 1.12.0 – 1.14.40 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:* | 1.5.4 – 1.5.27 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:* | 0.13 – 0.13.3 | Vulnerable | moonlight-stream |
| cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:* | 0.9.2 – 0.9.3 | Vulnerable | moonlight-stream |
- cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:* Versions 2022-11-04 to before 2023-10-06 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:* Versions 8.4.0 – 8.5.0 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:* Versions 8.4.0 – 8.5.0 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:* Versions 10.10 – 11.0 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:* Versions 0.10.22 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:* Versions 1.12.0 – 1.14.40 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:* Versions 1.5.4 – 1.5.27 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:* Versions 0.13 – 0.13.3 Vulnerable ·moonlight-stream
- cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:* Versions 0.9.2 – 0.9.3 Vulnerable ·moonlight-stream
Remediation
- Fix · CNA moonlight-common-c (moonlight-stream) Fixed in 24750d4b748fefa03d09fcfd6d45056faca354e0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-42800
References
Exploit 1
Patch 2
More moonlight-stream Moonlight vulnerabilities
- TI-2023-22890 Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString` CVSS 3.1HIGH 8.8
- TI-2020-08898 Man-in-the-middle attack in Moonlight iOS/tvOS CVSS 3.1HIGH 8.2
- TI-2023-22892 Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString` CVSS 3.1HIGH 7.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences