CVE-2023-42799
Description
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e.
How to fix
- moonlight-stream moonlight-common-c2023-10-06 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moonlight-stream moonlight-common-c | 2022-11-04 ≤ v < 2023-10-06 | 2023-10-06 |
| moonlight-stream moonlight | 8.4.0 ≤ v ≤ 8.5.0, 10.10 ≤ v ≤ 11.0, 0.10.22 | — |
| moonlight-stream moonlight_embedded | 2.6.0 | — |
| moonlight-stream moonlight_xbox | 1.12.0 ≤ v ≤ 1.14.40 | — |
| moonlight-stream moonlight_tv | 1.5.4 ≤ v ≤ 1.5.27 | — |
| moonlight-stream moonlight_switch | 0.13 ≤ v ≤ 0.13.3 | — |
| moonlight-stream moonlight_vita | 0.9.2 ≤ v ≤ 0.9.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.