CVE-2023-42800
Description
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.
How to fix
- moonlight-stream moonlight-common-c2023-10-06 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moonlight-stream moonlight-common-c | 2022-11-04 ≤ v < 2023-10-06 | 2023-10-06 |
| moonlight-stream moonlight | 8.4.0 ≤ v ≤ 8.5.0, 10.10 ≤ v ≤ 11.0, 0.10.22 | — |
| moonlight-stream moonlight_embedded | 2.6.0 | — |
| moonlight-stream moonlight_xbox | 1.12.0 ≤ v ≤ 1.14.40 | — |
| moonlight-stream moonlight_tv | 1.5.4 ≤ v ≤ 1.5.27 | — |
| moonlight-stream moonlight_switch | 0.13 ≤ v ≤ 0.13.3 | — |
| moonlight-stream moonlight_vita | 0.9.2 ≤ v ≤ 0.9.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.