PT-2023-28586 · Unknown · Moonlight-Common-C

K3An3

·

Published

2023-12-14

·

Updated

2023-12-20

·

CVE-2023-42799

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Moonlight-common-c versions prior to the version containing commit 02b7742f4d19631024bd766bd2bb76715780004e
Description The issue is related to a buffer overflow vulnerability in Moonlight-common-c, which contains the core GameStream client code. This vulnerability is due to the unmitigated usage of unsafe C functions and improper bounds checking, starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9. A malicious game streaming server could exploit this vulnerability to crash a Moonlight client or achieve remote code execution (RCE) on the client, especially if exploit mitigations are insufficient or can be bypassed.
Recommendations For Moonlight-common-c versions prior to the version containing commit 02b7742f4d19631024bd766bd2bb76715780004e, update to a version that includes the fix for the buffer overflow vulnerability. As a temporary workaround, consider restricting access to the Moonlight client until the update is applied to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-42799
GHSA-R8CF-45F4-VF8M

Affected Products

Moonlight-Common-C