The vulnerability is a remote heap buffer overflow in the Moonlight Qt H.264 SPS fixup path. When a streaming session is established with a malicious host that sends a crafted seq_parameter_set_id in the SPS NAL unit, the decoder uses h264bitstream to index a 32‑entry sps_table without bounds checking. A value of 32 or higher triggers an out‑of‑bounds write and corrupts the Moonlight client’s heap, which consistently results in a client crash. No evidence of code execution has been demonstrated; the impact is limited to denial of service at the client side.

Affected products are Moonlight Qt version 6.1.0 and earlier from the moonlight-stream:moonlight-qt vendor. The client runs on Windows, macOS, Linux, and Steam Link devices that support GameStream, and any such system that runs a vulnerable version can be targeted.

The CVSS score of 6.5 classifies the flaw as moderate severity. EPSS data is not currently available and the vulnerability is not listed in the CISA KEV catalog, indicating that mass exploitation is unlikely at present. Nonetheless, the attack vector is remote: a malicious host can compromise a client simply by providing a specially crafted H.264 stream. The risk is primarily a reliable client crash, which affects availability but does not permit unauthorized code execution or data exfiltration.