CVE-2026-41210 in Moonlight Qt
Summary
by MITRE • 10/12/2026
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Moonlight Qt versions 6.1.0 and earlier represents a critical security flaw within the video decoding subsystem of this popular GameStream client application. Moonlight serves as an open-source implementation for NVIDIA GeForce Experience's GameStream technology, allowing users to stream games from remote hosts running compatible GPUs to various platforms including Windows, macOS, Linux, and Steam Link devices. The core issue arises during the initialization and processing phase of a streaming session when the client connects to a potentially malicious or compromised host server. In this specific attack scenario, the victim initiates a connection expecting legitimate game stream data, but instead receives crafted network packets containing malformed H.264 video streams designed specifically to exploit weaknesses in the local decoding logic.
The technical root cause of this vulnerability lies in an out-of-bounds write condition triggered by improper validation of sequence parameter set identifiers within the H.264 bitstream parsing routine. Specifically, when Moonlight selects a decoder path that does not advertise support for CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, it falls back to a fixup mechanism located in the ffmpeg.cpp module. This fallback path utilizes the h264bitstream library to parse server-provided data structures. The flaw occurs because the application fails to validate the seq_parameter_set_id field extracted from the malicious H.264 SPS NAL unit before using it as an index into a fixed-size array named sps_table, which has a capacity of only thirty-two entries. Consequently, if an attacker crafts an SPS packet with a seq_parameter_set_id value of thirty-two or greater, the application performs a write operation beyond the allocated bounds of this heap-allocated buffer.
This memory corruption results in remote heap exploitation that compromises the integrity of the Moonlight client process on the victim's machine. While initial analysis and demonstration indicate that the primary observable impact is a reliable denial-of-service condition manifested as a client crash, the underlying nature of an out-of-bounds write poses significant risks for more severe outcomes such as arbitrary code execution or privilege escalation depending on memory layout conditions at runtime. The vulnerability aligns with CWE-787 Out-of-bounds Write and falls under ATT&CK technique T1203 Exploitation for Client Execution, highlighting the danger of processing untrusted media data in client-side applications without rigorous input sanitization.
To mitigate this risk, users must immediately upgrade to Moonlight version 6.2.0 or later where the validation logic has been corrected to ensure that array indices remain within valid bounds before access occurs. Additionally, organizations deploying GameStream infrastructure should enforce strict network segmentation and monitor for anomalous video stream patterns originating from untrusted sources. Implementing defense-in-depth strategies such as enabling sandboxed execution environments for media processing components can further reduce the blast radius of similar vulnerabilities in future software versions.