Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString`
CVE-2023-42801
What is CVE-2023-42801?
Moonlight-common-c, the core codebase shared among Moonlight GameStream clients, is exposed to a buffer overflow vulnerability that could lead to client crashes. Exploitation of this vulnerability requires a malicious game streaming server to deceive the client into pairing with it. While remote code execution (RCE) is theoretically possible, practical exploitation is minimized by the implementation of stack canaries in the official binaries. However, unofficial clients may lack these protections, increasing risk. The issue originates in the codebase since commit f57bd745b4cbed577ea654fad4701bea4d38b44c and has been mitigated in subsequent commits.
Affected Version(s)
moonlight-common-c >= f57bd745b4cbed577ea654fad4701bea4d38b44c, < b2497a3918a6d79808d9fd0c04734786e70d5954