CVE-2026-41210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41210
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41210.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41210
Aliases
  • GHSA-5rvh-v25g-vrgv
Published
2026-10-12T21:25:03Z
Modified
2026-10-15T07:07:21Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id
Details

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41210.json"
}
References

Affected packages

Git / github.com/moonlight-stream/moonlight-qt

Affected ranges

Type
GIT
Repo
https://github.com/moonlight-stream/moonlight-qt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e24a7a1a5369163482ce5a76d5232536e03c53f
Fixed
b7adc70ea474f7448c6185081ad9fc87b0b47cf0
Fixed
de2467e433821664cdd2224aad8c89a625be1ad9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.2.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.3
v0.0.4
v0.0.4a
v0.0.5
v0.1.0
v0.10.0
v0.10.1
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.7.0
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v2.*
v2.0.0
v2.1.0
v2.2.0
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.2.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v5.*
v5.0.0
v5.0.1
v6.*
v6.0.0
v6.0.1
v6.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41210.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "310776882259343073534468549941006098402",
            "length":  3378
        },
        "id":  "CVE-2026-41210-1b64233d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_stream.c",
            "function":  "write_seq_parameter_set_rbsp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "308320202133865931529727968354908848920",
            "length":  327
        },
        "id":  "CVE-2026-41210-2584df00",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_stream.c",
            "function":  "write_scaling_list"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64044082023365294151755829510337940374",
            "length":  3498
        },
        "id":  "CVE-2026-41210-3ddaf3e5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_stream.c",
            "function":  "read_seq_parameter_set_rbsp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "148215795994660162462418150699616983205",
                "194861932061202300032587135117929807807",
                "52736860758034914712321354596036870471",
                "320725853897898068695865660127431448746",
                "104817032630697278076837693029760088039",
                "194145449998384081962426573846976200700",
                "107682055693071075207485914186971723639",
                "307796039281296948338389038208715919035",
                "7709798804544970210686900057905692900",
                "35187064029277449499473590389773576378",
                "184425543664143674818796416472291141893",
                "123146478422555140007553722293471973131",
                "271151975854261795702296090860800878653",
                "33236974582444259571564879218036057048",
                "148548586664148653004993566774556889431",
                "69203281956478444411576049566802342813",
                "51790799995182666707459135515470262074",
                "75479315325163819443811065706202639108",
                "22997622786638606779613004030041885544"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-41210-47887964",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/bs.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317156882048021612120135130463244212661",
            "length":  167
        },
        "id":  "CVE-2026-41210-56287c0c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/bs.h",
            "function":  "bs_write_se"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "98511680549305036088612438570687748519",
                "215679022611711152005222468513181833301",
                "269916799338142556570524040036845131830",
                "217251078280646057530311272938741147301",
                "291113450313473718188300406128007675236",
                "78052876060350540710249374574900616626",
                "245442682912833609812667448270584936889",
                "224717642008904632319697482675601519188",
                "74027023640472701730284964814445213981",
                "268761596429191111973021354035350342146",
                "145407092525991793808568618183633980488",
                "290139448459704939637869816425225111327",
                "72184944402730829309060482146596810739",
                "189586119749170249663957861661718830933",
                "144640930440016803060023246757893024908",
                "310943585298102499506690266137723868417",
                "207312022861017955843734331353432489109",
                "271377540565086557714521996050956120545"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-41210-630c9441",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_stream.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "93409489681786555910264857417643181808",
            "length":  881
        },
        "id":  "CVE-2026-41210-8de57d02",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_nal.c",
            "function":  "find_nal_unit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "221530628603421780238895367231711015796",
            "length":  708
        },
        "id":  "CVE-2026-41210-caa4c711",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_stream.c",
            "function":  "read_hrd_parameters"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "45597307144840609576298549758016637924",
                "137781334738180701832896812963902332",
                "262730349753624729760020275703308831400",
                "265165142839702401748764335939850664115",
                "120518343222955030218802957811698909698",
                "239497306201231223033423201604876299976",
                "326775091473191067052573372160479176928",
                "252555507335451118977539603094373889529",
                "73128903107351672671878942350987339996",
                "189455922288524990173029425390499524401",
                "232400127932988334174991512998099116973",
                "326960127274490487081743181989034457547",
                "130770614186286776621746552967254116752",
                "49676682877254703391034550659929698178",
                "291383971510162483635060653386173188798",
                "196825752203618272858572150132521881106",
                "270601786634365821736142716675523244199",
                "170261037507262195596233292422665429849",
                "13814518655969687357551172792208799175",
                "289378639883051276342050128446836746151",
                "201153948965641398370683241249429486172",
                "33550725745395393175333637494579639821",
                "32380691566073211168015782259338669610",
                "99224289861648586195352987290454076220",
                "311278240803248976703757805474816868610",
                "284983498018080785453318044400059218236"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-41210-d42ed79b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/h264_nal.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "214093548679247278399067868369802096469",
            "length":  249
        },
        "id":  "CVE-2026-41210-e44e0667",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/moonlight-stream/moonlight-qt/commit/3e24a7a1a5369163482ce5a76d5232536e03c53f",
        "target":  {
            "file":  "h264bitstream/bs.h",
            "function":  "bs_read_ue"
        }
    }
]
vanir_signatures_modified 
"2026-10-15T07:07:21Z"