{"id":"CVE-2026-41210","summary":"Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id","details":"Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.","aliases":["GHSA-5rvh-v25g-vrgv"],"modified":"2026-10-15T07:07:21.393138025Z","published":"2026-10-12T21:25:03.303Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41210.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/moonlight-stream/moonlight-qt/releases/tag/v6.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41210.json"},{"type":"ADVISORY","url":"https://github.com/moonlight-stream/moonlight-qt/security/advisories/GHSA-5rvh-v25g-vrgv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41210"},{"type":"FIX","url":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f"},{"type":"FIX","url":"https://github.com/moonlight-stream/moonlight-qt/commit/b7adc70ea474f7448c6185081ad9fc87b0b47cf0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moonlight-stream/moonlight-qt","events":[{"introduced":"0"},{"fixed":"3e24a7a1a5369163482ce5a76d5232536e03c53f"},{"fixed":"b7adc70ea474f7448c6185081ad9fc87b0b47cf0"},{"fixed":"de2467e433821664cdd2224aad8c89a625be1ad9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.2.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v6.1.0","v6.0.1","v6.0.0","v5.0.1","v5.0.0","v4.3.1","v4.3.0","v4.2.1","v4.2.0","v4.1.0","v4.0.0","v3.2.0","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.0","v2.2.0","v2.1.0","v2.0.0","v1.2.1","v1.2.0","v1.1.1","v1.1.0","v1.0.1","v1.0.0","v0.10.1","v0.10.0","v0.9.1","v0.9.0","v0.8.1","v0.8.0","v0.7.0","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.0","v0.2.0","v0.1.0","v0.0.5","v0.0.4a","v0.0.4","v0.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41210.json","vanir_signatures":[{"source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/h264_stream.c","function":"write_seq_parameter_set_rbsp"},"deprecated":false,"digest":{"length":3378,"function_hash":"310776882259343073534468549941006098402"},"id":"CVE-2026-41210-1b64233d","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"function":"write_scaling_list","file":"h264bitstream/h264_stream.c"},"deprecated":false,"digest":{"function_hash":"308320202133865931529727968354908848920","length":327},"id":"CVE-2026-41210-2584df00"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"function":"read_seq_parameter_set_rbsp","file":"h264bitstream/h264_stream.c"},"deprecated":false,"digest":{"function_hash":"64044082023365294151755829510337940374","length":3498},"id":"CVE-2026-41210-3ddaf3e5"},{"deprecated":false,"digest":{"line_hashes":["148215795994660162462418150699616983205","194861932061202300032587135117929807807","52736860758034914712321354596036870471","320725853897898068695865660127431448746","104817032630697278076837693029760088039","194145449998384081962426573846976200700","107682055693071075207485914186971723639","307796039281296948338389038208715919035","7709798804544970210686900057905692900","35187064029277449499473590389773576378","184425543664143674818796416472291141893","123146478422555140007553722293471973131","271151975854261795702296090860800878653","33236974582444259571564879218036057048","148548586664148653004993566774556889431","69203281956478444411576049566802342813","51790799995182666707459135515470262074","75479315325163819443811065706202639108","22997622786638606779613004030041885544"],"threshold":0.9},"id":"CVE-2026-41210-47887964","signature_type":"Line","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/bs.h"}},{"source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/bs.h","function":"bs_write_se"},"deprecated":false,"digest":{"function_hash":"317156882048021612120135130463244212661","length":167},"id":"CVE-2026-41210-56287c0c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["98511680549305036088612438570687748519","215679022611711152005222468513181833301","269916799338142556570524040036845131830","217251078280646057530311272938741147301","291113450313473718188300406128007675236","78052876060350540710249374574900616626","245442682912833609812667448270584936889","224717642008904632319697482675601519188","74027023640472701730284964814445213981","268761596429191111973021354035350342146","145407092525991793808568618183633980488","290139448459704939637869816425225111327","72184944402730829309060482146596810739","189586119749170249663957861661718830933","144640930440016803060023246757893024908","310943585298102499506690266137723868417","207312022861017955843734331353432489109","271377540565086557714521996050956120545"],"threshold":0.9},"id":"CVE-2026-41210-630c9441","signature_type":"Line","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/h264_stream.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/h264_nal.c","function":"find_nal_unit"},"deprecated":false,"digest":{"function_hash":"93409489681786555910264857417643181808","length":881},"id":"CVE-2026-41210-8de57d02"},{"source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"function":"read_hrd_parameters","file":"h264bitstream/h264_stream.c"},"deprecated":false,"digest":{"function_hash":"221530628603421780238895367231711015796","length":708},"id":"CVE-2026-41210-caa4c711","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f","target":{"file":"h264bitstream/h264_nal.c"},"deprecated":false,"digest":{"line_hashes":["45597307144840609576298549758016637924","137781334738180701832896812963902332","262730349753624729760020275703308831400","265165142839702401748764335939850664115","120518343222955030218802957811698909698","239497306201231223033423201604876299976","326775091473191067052573372160479176928","252555507335451118977539603094373889529","73128903107351672671878942350987339996","189455922288524990173029425390499524401","232400127932988334174991512998099116973","326960127274490487081743181989034457547","130770614186286776621746552967254116752","49676682877254703391034550659929698178","291383971510162483635060653386173188798","196825752203618272858572150132521881106","270601786634365821736142716675523244199","170261037507262195596233292422665429849","13814518655969687357551172792208799175","289378639883051276342050128446836746151","201153948965641398370683241249429486172","33550725745395393175333637494579639821","32380691566073211168015782259338669610","99224289861648586195352987290454076220","311278240803248976703757805474816868610","284983498018080785453318044400059218236"],"threshold":0.9},"id":"CVE-2026-41210-d42ed79b","signature_type":"Line","signature_version":"v1"},{"target":{"file":"h264bitstream/bs.h","function":"bs_read_ue"},"deprecated":false,"digest":{"function_hash":"214093548679247278399067868369802096469","length":249},"id":"CVE-2026-41210-e44e0667","signature_type":"Function","signature_version":"v1","source":"https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f"}],"vanir_signatures_modified":"2026-10-15T07:07:21Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}