CVE-2023-42800: Moonlight-Stream Moonlight

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.

Affected products

• Moonlight-Stream Moonlight: from 8.4.0, up to and including 8.5.0; from 10.10, up to and including 11.0; version 0.10.22 only
• Moonlight-Stream Moonlight-Common-C: from 2022-11-04, before 2023-10-06 (fixed in 2023-10-06)
• Moonlight-Stream Moonlight Embedded: version 2.6.0 only
• Moonlight-Stream Moonlight Switch: from 0.13, up to and including 0.13.3
• Moonlight-Stream Moonlight Tv: from 1.5.4, up to and including 1.5.27
• Moonlight-Stream Moonlight Vita: from 0.9.2, up to and including 0.9.3
• Moonlight-Stream Moonlight Xbox: from 1.12.0, up to and including 1.14.40

Published 2023-12-14. Last modified 2026-06-17.