CVE-2026-41210

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210

The Moonlight Qt GameStream client (versions 6.1.0 and earlier ) is vulnerable to a remote heap buffer overflow . When a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL if Moonlight selects a decoder path lacking CAPABILITY_REFERENCE_FRAME_INVAL...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

EUVD-2026-97966

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-41210: Out-of-bounds Write

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

PT-2026-110970

Name of the Vulnerable Software and Affected Versions Moonlight Qt versions prior to 6.2.0 Description A remote heap corruption occurs when a user initiates a streaming session to a malicious host. The host can send a crafted H.264 SPS NAL Network Abstraction Layer when the client selects a decod...

Malicious code in iris-7sth0-wdjq6-moonlight-project (npm)

The package iris-7sth0-wdjq6-moonlight-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in iceberg-lct0z-lyaw0-moonlight-project (npm)

The package iceberg-lct0z-lyaw0-moonlight-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in emerald-v5nct-6ad1h-moonlight-project (npm)

The package emerald-v5nct-6ad1h-moonlight-project was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-32253

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509VERRUNABLETOGETISSUERCERTLOCALLY,...

CVE-2026-32253

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509VERRUNABLETOGETISSUERCERTLOCALLY,...

EUVD-2020-3409

Malware in sbrugna...

EUVD-2011-1004

Malware in sbrugna...

EUVD-2023-47226

Malicious code in bioql PyPI...

EUVD-2023-47228

Malicious code in bioql PyPI...

CVE-2025-54081 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager SCM interprets the path...

Sunshine security vulnerabilities

Sunshine is an open source self-service game streaming host for Moonlight by LizardByte. A security vulnerability exists in versions prior to Sunshine 2025.923.33222, which stems from the Windows service SunshineService being installed without wrapping the executable path in quotes, which could...

PT-2025-39202

Name of the Vulnerable Software and Affected Versions Sunshine versions prior to 2025.923.33222 Description Sunshine, a self-hosted game stream host for Moonlight, is affected by an issue where the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is...