CVE-2026-41210: Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITYREFERENCEFRAMEINVALIDATIONAVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seqparametersetid is used to index the 32-entry spstable without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moonlight Qtto a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Which clients are exposed to this issue?
Moonlight Qt 6.1.0 and earlier are affected on Windows, macOS, Linux, and Steam Link, but only when the selected decoder path does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC.
What does an attacker need to exploit it?
The victim must initiate a streaming session to a malicious GameStream host. The malicious host can then provide a crafted H.264 SPS NAL with a seq_parameter_set_id of 32 or greater.
What is the known impact?
The demonstrated result is a reliable crash of the Moonlight client caused by remote heap corruption. Code execution has not been established.
What should be done if an update cannot be applied immediately?
Do not initiate Moonlight streaming sessions to untrusted or malicious hosts. Exploitation requires the attacker to act as the streaming host after a session is started.
How can this be remediated?
Upgrade Moonlight Qt to version 6.2.0, which fixes the issue.