Moonlight Qt heap buffer overflow via crafted H.264 SPS seq_parameter_set_id
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A remote heap buffer overflow in Moonlight Qt, a GameStream client for Windows, macOS, Linux and Steam Link, affects versions 6.1.0 and earlier. After a victim starts a streaming session with a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight uses a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp indexes the 32-entry sps_table with an unvalidated seq_parameter_set_id, so a value of 32 or greater writes out of bounds and corrupts client heap memory. The demonstrated impact is a reliable client crash; code execution is not established.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moonlight-stream | moonlight-qt | before 6.2.0 | 6.2.0 | Patch available | CNA |
- moonlight-qt Vendormoonlight-stream Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA
Remediation
Upgrade Moonlight Qt to version 6.2.0, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA moonlight-qt (moonlight-stream) Fixed in 6.2.0
Timeline
- 2026-10-12 Threatist record created from CVE-2026-41210
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
References
Other 4
- https://github.com/moonlight-stream/moonlight-qt/security/advisories/GHSA-5rvh-v25g-vrgv
- https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f
- https://github.com/moonlight-stream/moonlight-qt/commit/b7adc70ea474f7448c6185081ad9fc87b0b47cf0
- https://github.com/moonlight-stream/moonlight-qt/releases/tag/v6.2.0
More moonlight-stream vulnerabilities
- TI-2023-22891 Buffer overflow due to use of `strcpy` in `performRtspHandshake` CVSS 3.1HIGH 8.8
- TI-2023-22890 Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString` CVSS 3.1HIGH 8.8
- TI-2020-08898 Man-in-the-middle attack in Moonlight iOS/tvOS CVSS 3.1HIGH 8.2
- TI-2023-22892 Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString` CVSS 3.1HIGH 7.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences