Moonlight Qt
Monthly
An out-of-bounds heap write in Moonlight Qt 6.1.0 and earlier allows an attacker-controlled GameStream host to corrupt memory in the Moonlight client and reliably crash it during an active streaming session. Exploitation requires the victim to voluntarily initiate a session to the malicious host and requires Moonlight to select a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, which sends the server's H.264 SPS data through the vulnerable fixup path in app/streaming/video/ffmpeg.cpp, where a seq_parameter_set_id of 32 or greater is used unvalidated to index the 32-entry sps_table. The assessed impact is availability-only client crash and heap corruption (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H); despite metadata tags referencing RCE, code execution has not been established, and no public exploit code has been identified at time of analysis. This is a medium-severity, client-side denial-of-service issue rather than a high-priority remote compromise.
An out-of-bounds heap write in Moonlight Qt 6.1.0 and earlier allows an attacker-controlled GameStream host to corrupt memory in the Moonlight client and reliably crash it during an active streaming session. Exploitation requires the victim to voluntarily initiate a session to the malicious host and requires Moonlight to select a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, which sends the server's H.264 SPS data through the vulnerable fixup path in app/streaming/video/ffmpeg.cpp, where a seq_parameter_set_id of 32 or greater is used unvalidated to index the 32-entry sps_table. The assessed impact is availability-only client crash and heap corruption (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H); despite metadata tags referencing RCE, code execution has not been established, and no public exploit code has been identified at time of analysis. This is a medium-severity, client-side denial-of-service issue rather than a high-priority remote compromise.