Moonlight Qt CVE-2026-41210

Exploitation requires that (1) the victim initiates a Moonlight streaming session to an attacker-controlled GameStream host, (2) Moonlight selects a decoder path that does NOT advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, which triggers the SPS fixup path in app/streaming/video/ffmpeg.cpp, and (3) the host sends a crafted H.264 SPS NAL with seq_parameter_set_id of 32 or greater, which is used unvalidated to index the 32-entry sps_table. Limiting factors that reduce realistic risk: mandatory user interaction (the victim must voluntarily connect to the malicious host rather than being targeted passively), dependence on a specific non-RFI-AVC decoder path being chosen at runtime, and an impact ceiling of client crash/heap corruption with no confirmed code execution.

This is a genuinely medium-severity, client-side denial-of-service issue rather than a high-priority remote compromise. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: the attack is network-delivered and low-complexity, but requires user interaction (UI:R) because the victim must first initiate a streaming session to an attacker-controlled host, and the only impact metric set is availability (A:H) with C:N/I:N. The Tags list 'RCE' and the product description explicitly states 'code execution is not established' - these conflict, and the authoritative signal is the description plus the C:N/I:N impact, so this should be treated as a reliable-crash DoS, not RCE. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of widespread or active exploitation; the published GitHub Security Advisory and patch commits do not constitute a weaponized PoC. The real-world risk is further constrained by the need for a specific decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC and by the requirement that the victim actively connect to a malicious host. Net assessment: a legitimate but low-urgency memory-corruption bug whose demonstrated impact is a crash; the 'RCE'/CWE-787 framing overstates real-world severity absent proof of code execution.

An attacker stands up a malicious GameStream host and persuades a victim to initiate a Moonlight streaming session to it (e.g. via a shared/advertised host address). When Moonlight selects a decoder path lacking CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, the host returns a crafted H.264 SPS NAL whose seq_parameter_set_id is 32 or greater, indexing past the 32-entry sps_table and causing an out-of-bounds heap write that reliably crashes the client. No public exploit code was identified in the input, though the fix commits and advisory describe the flaw in detail.