PatchSiren

moonlight-stream CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM moonlight-stream CVE published 2026-10-12

CVE-2026-41210

A remote heap buffer overflow vulnerability exists in Moonlight Qt versions 6.1.0 and earlier. An attacker can exploit this vulnerability by sending a crafted H.264 SPS NAL to a victim during a streaming session, potentially causing a client crash or other unexpected behavior due to remote heap corruption. The issue is fixed in version 6.2.0. This vulnerability is a result of the SPS fixup path in app/str [truncated]