CVE-2026-41210

Received Received - Intake

Heap Corruption in Moonlight Qt via H.264 SPS NAL

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-41210

Affected Vendors & Products

Vendor	Product	Version / Range
moonlight-stream	moonlight-qt	< 6.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Moonlight Qt versions 6.1.0 and earlier. It allows a malicious host to send a specially crafted H.264 video stream parameter to a victim's client during a streaming session. The client's code incorrectly handles this parameter, leading to a memory corruption issue where an attacker can write outside the intended memory bounds. This can cause the client to crash but does not currently allow for code execution.

Detection Guidance

This vulnerability can be detected by checking the Moonlight Qt version installed on your system. If you are running version 6.1.0 or earlier, your system is vulnerable. Run the command 'moonlight-qt --version' or check your package manager for the installed version.

Impact Analysis

If you use Moonlight Qt to stream games or applications, an attacker could exploit this vulnerability by tricking you into connecting to a malicious server. This could cause your Moonlight client to crash during the streaming session, disrupting your experience. While remote code execution is not confirmed, the crash itself could lead to denial of service or potential instability on your system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a client-side crash issue without confirmed code execution. However, if exploited to cause denial-of-service, it could impact availability of systems processing sensitive data, potentially violating availability requirements in GDPR and HIPAA.

Mitigation Strategies

Immediately update Moonlight Qt to version 6.2.0 or later to patch the vulnerability. If updating is not possible, avoid connecting to untrusted streaming hosts to reduce exposure.

Hi! I’m here to help you understand CVE-2026-41210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70