CVE-2026-41210 moonlight-stream CVE debrief

Who should care

Defenders responsible for systems using Moonlight Qt versions 6.1.0 and earlier should prioritize updating to version 6.2.0 or later to prevent potential client crashes or other unexpected behavior due to remote heap buffer overflow. Systems using affected versions should be inventoried and patched. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, and

Why it matters

Defenders should care about CVE-2026-41210 because it can cause client crashes in Moonlight Qt versions 6.1.0 and earlier. Updating to version 6.2.0 or later can prevent this issue. Systems using affected versions should be inventoried and patched.

• Potential client crashes due to remote heap buffer overflow
• Need to verify fix and monitor for crashes
• Update priority for affected systems

Technical summary

The vulnerability exists in the H.264 SPS fixup path in Moonlight Qt versions 6.1.0 and earlier. An attacker can send a crafted H.264 SPS NAL to a victim during a streaming session, potentially causing a client crash or other unexpected behavior due to a remote heap buffer overflow. This occurs because the SPS fixup path in app/streaming/video/ffmpeg.cpp parses server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in Moonlight Qt. The demonstrated impact is a reliable client crash, while code execution is not established.

Defensive priority

Defenders should prioritize updating Moonlight Qt to version 6.2.0 or later to prevent potential client crashes. Systems using affected versions should be inventoried and patched.

Recommended defensive actions

• Update Moonlight Qt to version 6.2.0 or later
• Inventory systems using affected versions and apply patches
• Monitor for potential client crashes and verify fix
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. However, the corpus does not establish exploitation or impact beyond client crashes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.