Moxygen
Monthly
Use-after-free in Meta's experimental moxygen Media-over-QUIC (MoQ) library (MoQSession::dataStreamReadLoop) lets a remote, unauthenticated peer corrupt memory and crash an endpoint that accepts MoQ sessions over proxygen's WebTransport API. The flaw is triggered when a data stream names an unknown/unresolved track alias and carries the FIN flag in the same write, so the stream read handle is invalidated by the FIN before the read loop finishes using it; affected builds are those from b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9 up to (excluding) the fix commit 004123dd24c30dad6b649163575145f240dabc94. Exploitation requires only that the target runs a vulnerable commit and exposes an accepting MoQ endpoint; there is no public exploit identified at time of analysis (EPSS 0.14%, third percentile; CISA SSVC exploitation:none), and the vendor fix is available as upstream commit 004123dd24c30dad6b649163575145f240dabc94.
Use-after-free in Meta's experimental moxygen Media-over-QUIC (MoQ) library (MoQSession::dataStreamReadLoop) lets a remote, unauthenticated peer corrupt memory and crash an endpoint that accepts MoQ sessions over proxygen's WebTransport API. The flaw is triggered when a data stream names an unknown/unresolved track alias and carries the FIN flag in the same write, so the stream read handle is invalidated by the FIN before the read loop finishes using it; affected builds are those from b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9 up to (excluding) the fix commit 004123dd24c30dad6b649163575145f240dabc94. Exploitation requires only that the target runs a vulnerable commit and exposes an accepting MoQ endpoint; there is no public exploit identified at time of analysis (EPSS 0.14%, third percentile; CISA SSVC exploitation:none), and the vendor fix is available as upstream commit 004123dd24c30dad6b649163575145f240dabc94.