Description
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moonlight-stream moonlight-qt
< 6.2.0affected
References
- https://github.com/moonlight-stream/moonlight-qt/security/advisories/GHSA-5rvh-v25g-vrgv ↗
- https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f ↗
- https://github.com/moonlight-stream/moonlight-qt/commit/b7adc70ea474f7448c6185081ad9fc87b0b47cf0 ↗
- https://github.com/moonlight-stream/moonlight-qt/releases/tag/v6.2.0 ↗