Remote Heap Corruption in Moonlight Qt GameStream Client for Multiple Platforms

CVE-2026-41210

What is CVE-2026-41210?

Moonlight Qt, a GameStream client compatible with Windows, macOS, Linux, and Steam Link, suffers from a remote heap corruption vulnerability. In versions 6.1.0 and earlier, when a user initiates a streaming session with a malicious host, the host can exploit the vulnerability by sending a specially crafted H.264 SPS NAL. The lack of proper validation during the parsing process allows for an out-of-bounds write, leading to remote heap corruption in the Moonlight client. The only demonstrated consequence is a reliable crash of the client, although there is no established pathway to code execution. This issue is addressed in version 6.2.0.

References