Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit f57bd745b4cbed577ea654fad4701bea4d38b44c. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client. Achieving RCE is possible but unlikely, due to stack canaries in use by modern compiler toolchains. The published binaries for official clients Qt, Android, iOS/tvOS, and Embedded are built with stack canaries, but some unofficial clients may not use stack canaries. This vulnerability takes place after the pairing process, so it requires the client to be tricked into pairing to a malicious host. It is not possible to perform using a man-in-the-middle due to public key pinning that takes place during the pairing process. The bug was addressed in commit b2497a3918a6d79808d9fd0c04734786e70d5954.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42801.json",
"cwe_ids": [
"CWE-120"
],
"cna_assigner": "GitHub_M"
}[
{
"events": [
{
"introduced": "2016-10-05"
},
{
"fixed": "2023-10-06"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.23"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.14.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.0"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-42801.json"
"2026-04-12T04:43:53Z"
[
{
"digest": {
"length": 2183.0,
"function_hash": "41018024721350750336562560406107365101"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-01050e7e",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "processRtpPayload",
"file": "src/VideoDepacketizer.c"
}
},
{
"digest": {
"length": 4998.0,
"function_hash": "259012674148839317206746762618172796441"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-058e2488",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "LiStartConnection",
"file": "src/Connection.c"
}
},
{
"digest": {
"length": 5013.0,
"function_hash": "133185908974077569146633548560492268424"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-06c2b1be",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "performRtspHandshake",
"file": "src/RtspConnection.c"
}
},
{
"digest": {
"length": 1012.0,
"function_hash": "318754337064770944137517063299845024302"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-175d42ed",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "initializeControlStream",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"133045675759389008998302039155818901635",
"144003698496216396911125589327163026706",
"263956782388670341000649543281723442721",
"146980974187962668966316156057232376158",
"205054021270125222071540084863522510407",
"222893373418542233027718193766617147096",
"161018642394377741466788541447505294857",
"251238442254493590390018079518337022583",
"118927503092402279992365986638983344429",
"153301676490980666378405826308598108955",
"339522049703495196637095220630088461893",
"250855150517692969073017749119669269581",
"327625409984104783247488100912101387753",
"205489532481930365593899137750644247959",
"155348193313302391668363254839030729700",
"59372033388779320750384418935726209847",
"66306168708515214676974898408979382324",
"32136218634586645254606293532832078813",
"127589276992617799363852190636467683731",
"107351943341062330066192141595603673724",
"9293609018826849754789645485517570676",
"324220254640429097205102230224181137553",
"224299967077918118510440165546763810913",
"188482001243217494048432952532066859727",
"89590929520094944223684558695826572459",
"210015490855005552580580136810367156507",
"290693723619337902982235545348203114280",
"150995453926621605779198640201064976005",
"170168140613636115444328967900100931266",
"138331021951485051138041418401726670388",
"41111836788110771778990644391360708178",
"174140789656872978132765433646373243807"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-18794bfa",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/RtspConnection.c"
}
},
{
"digest": {
"length": 286.0,
"function_hash": "169042246224401236969338543423340329599"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-1ee3610f",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendMessageAndForget",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"326230600531008950790115475316179680963",
"138346875078125884474772419607442070593",
"274548746962937076720745989921370242238",
"21012711107263222157205746720981309",
"296329143370793620201080744067932787353",
"70910965459718647396920497422098853505",
"202138351106005160921293676661372274308",
"172055074868110454547638627166887141141"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-22de6a5d",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/VideoStream.c"
}
},
{
"digest": {
"length": 198.0,
"function_hash": "156185207017528427433966663245768821178"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-2d72d903",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendInputPacketOnControlStream",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"44661782871919989726799605522570691746",
"309401192900604386377853671857137818346",
"7830012912492670989051594231987210842",
"123407277379030923333705235982117178999",
"316621544210938120680682831675154277595",
"242160701998180422941552446733232434525",
"23983757077746512272985725424677509266",
"205733962459777950888350934075490661676",
"10246334043042845210155434360091945800",
"171574433625885935355632310679186281833",
"47490264684612912001094506959106929372",
"123452965674021843048982671122329388108",
"80101822202634580870675933374049345462",
"82131700933735802608533548176675719909",
"69238058765144171356184217231253177891",
"320027224565361342547049595551518986695",
"102904716024415427294740033328589063710",
"71154408622609912215111077260442479092",
"251617767779009194274039791978631273354"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-3afbc7b3",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/Connection.c"
}
},
{
"digest": {
"length": 3809.0,
"function_hash": "154139978680102986973031329495433739633"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-4ad44621",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "inputSendThreadProc",
"file": "src/InputStream.c"
}
},
{
"digest": {
"length": 2107.0,
"function_hash": "310745837542080633057040781224789851474"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-51736574",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendControllerEventInternal",
"file": "src/InputStream.c"
}
},
{
"digest": {
"length": 233.0,
"function_hash": "64721964310366224137211249206632537991"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-55fcfa8e",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "transactRtspMessage",
"file": "src/RtspConnection.c"
}
},
{
"digest": {
"length": 153.0,
"function_hash": "239466933053740162468459585323664280703"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-5953786a",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "fillSdpTail",
"file": "src/SdpGenerator.c"
}
},
{
"digest": {
"length": 798.0,
"function_hash": "224434552392646418689219768139923205076"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-6722c3d0",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "LiSendScrollEvent",
"file": "src/InputStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"186280245737500958135643698660261328181",
"83674827782503535471966228271436701103",
"234548339326090939131549346071583056807",
"319803429480641510404435132371038268797",
"90013877500852239827084423080062917852",
"31868864323875830664913300299950059255",
"182850350981109964008317800491794891626",
"286724445879061022839513260078695887418",
"145536857414186739612846660173101939572",
"123264756179130479780500474313693945273",
"233804911567552692302020309934743629781",
"284563376590487105126293500923346692961",
"198168700509262759984549720992643195297",
"195097479211935445089554623813824861198",
"30512487723559733040372462709456039826",
"43195853140816210806407193561756808283",
"249040415913228165020806537535843620058",
"233902894864992949787792431307132660391",
"119385813078689617251267829264311962535",
"22901699085634251603157049070121049404",
"95084477526720344886003495411227316751"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-685cbf49",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/SdpGenerator.c"
}
},
{
"digest": {
"length": 365.0,
"function_hash": "119161826024745104298064241691160088417"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-6efbcdf1",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "startInputStream",
"file": "src/InputStream.c"
}
},
{
"digest": {
"length": 3310.0,
"function_hash": "261993147500079446164019622987465143883"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-73c2a2d0",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "getAttributesList",
"file": "src/SdpGenerator.c"
}
},
{
"digest": {
"length": 883.0,
"function_hash": "269712276068113110491149161859075582104"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-78c3b13a",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "requestIdrFrame",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"length": 635.0,
"function_hash": "46248257598499240572927133987236062039"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-7a66c724",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "LiSendMouseButtonEvent",
"file": "src/InputStream.c"
}
},
{
"digest": {
"length": 477.0,
"function_hash": "260692170580467049013569815684013970634"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-8c230dda",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendMessageTcp",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"246440655807584907275337656091682834376",
"49399374465595508048244392021617320860",
"164543436941978183258306591983608572944",
"88898080992629975178784321702996438906"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-9328830e",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/VideoDepacketizer.c"
}
},
{
"digest": {
"length": 616.0,
"function_hash": "195994619331386167833410521336748877471"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-9567d20c",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendMessageAndDiscardReply",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"length": 1047.0,
"function_hash": "279511810028811817088428450090283760427"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-97dd5032",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "startVideoStream",
"file": "src/VideoStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"72032298487525887561297262940703490147",
"21466874038620413269738943643654110599",
"131784121748589294208682220258170471421",
"167962010140245920210856954463494848721"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-a00a2ed9",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/Misc.c"
}
},
{
"digest": {
"length": 651.0,
"function_hash": "22125048129970409313944497620444632600"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-c31ec405",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "setupStream",
"file": "src/RtspConnection.c"
}
},
{
"digest": {
"length": 1653.0,
"function_hash": "324535757881216813099885795828929745247"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-c5dbcc1c",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "startControlStream",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"length": 691.0,
"function_hash": "246987954982890394328007077925962179122"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-cbe7ec9e",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "LiSendMouseMoveEvent",
"file": "src/InputStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"151987626967678838651801197211264383985",
"83941985699612862268664697250267386522",
"2281548885382547984213299795368432379",
"98374284035752532431600232388768183649",
"199320924452208319011335820284337503018"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-d8822909",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/Limelight.h"
}
},
{
"digest": {
"length": 1551.0,
"function_hash": "107354357836657488904948303704177020442"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-df5014a7",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "encryptData",
"file": "src/InputStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"329261004544724679952521329985176622092",
"333259221010532386929369505434548031416",
"144137309245255883932134341250664826378",
"173495957435577190277875808171640778172",
"134740363847286988479212492839642159182",
"236362536350133201203897928657168011823",
"327857836705336343658243734445396284677",
"52925069489500742868921050514359817334",
"326995864654266149489344515839048879294",
"274817032417437743808930833855963111451",
"44999931731773935687787850600681371194",
"241007371967100902891925933433088356147",
"145141738509313693866369016588401986290",
"293361475693701940150772701201676110752",
"97854798809762918086385785056685632928",
"53162647039410994426445501099819624520",
"224465680388041592793251316832350983773",
"13855250302244431712856097146840194663",
"232399587268488753083410279359188011292",
"84831314321871529976296936565330350233",
"309639628285530304958601629654707844519",
"206766427915379175401915079776456332379",
"109341485653248028845503707600827561368",
"75218732683726244182887809368144660502",
"320089889804532202261436565496783018125",
"206549343194901593827977230076444917460",
"33375515333738230797855237413133393243",
"132515586940015518921573782633440742652",
"270771139083207338477623785097894338930",
"121500938948577017964872782091602595068",
"230595282225163519229763992254034042074",
"104801141736296891409336181996491636608",
"88337841256596336787070109818619104893",
"338550084950953486930086269769831352634",
"91376652916784978757487037490897766809",
"161071040438511705152770118705448375911",
"270430144496833283105034398348686456862",
"336117149111304411513975584429627170941",
"92318848854095025641385600318605205951",
"29143100312752562142838273758082884660",
"146653057703358028575123980865668698541",
"59372033388779320750384418935726209847"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-e989dc95",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"46338547784404206870550743454455896732",
"223901712904737167325570292201351182063",
"252842554387464471759789644349285166801",
"100152276299832753414088889058403611657",
"257749825253070320131601083794728225691",
"112160305267532894377685290173321192382",
"21381576871187633488850203212357114208",
"80708484635112577741631690403655377741"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-ea9877c2",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/Limelight-internal.h"
}
},
{
"digest": {
"length": 1040.0,
"function_hash": "180551240230886672928967859545299113405"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2023-42801-f1ba6dd1",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"function": "sendMessageEnet",
"file": "src/ControlStream.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"270479378338465285165399289857084861622",
"179010731779462751865932539809928555564",
"65379771202507937155685208336933655747",
"88160515581770091319993148799730095524",
"166772349871836372480549948518174540406",
"305668780240981326501260880811341655057",
"98766518225043424961346482202040987343",
"129147323369967334959610571859883027373",
"214986550769336862951899895315763668278",
"306760301662155916120832084019128884541",
"66825486581652480405190529119943123549",
"91665035479339636134699547618667607134",
"133367224269204691299884610490855974749",
"256254448265802096052365474136729071718",
"275572048368166338443241325612654372541",
"276144150228506771986789632511087066979",
"154531499418888317730976831704311216171",
"235619476800296136093053227513566985362",
"132934574932992326683194961145853725024",
"18705627531029363044929710390302688616",
"197701422350994629087550293160758706629",
"283978043451755391547260847219304216239",
"108488823679468736954296230920606699848",
"73976315129006442096942592481842120756",
"25890707686959960006179518775314217210",
"185497324054936489478640627886247881137",
"46515606992004547251956411739545826662",
"159874195278889048329001869998861357107",
"296409774587545927245304100603464836824",
"33142260551472953506196051167988183344",
"73538044444991413050874996323025199627",
"304468757756876058082842274410921942948",
"18831109368737921444170605182904856188",
"310192864073152186405246552686144328169",
"202708031909516456909313064296199412049",
"98634707053109569821434931472510942132"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2023-42801-f54fdf13",
"signature_version": "v1",
"source": "https://github.com/moonlight-stream/moonlight-common-c/commit/f57bd745b4cbed577ea654fad4701bea4d38b44c",
"target": {
"file": "src/InputStream.c"
}
}
]