« Volver al listado

CVE-2023-42799

Estado: ModificadaAlta (8.8)—

Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (7)

Moonlight-stream — MoonlightMoonlight-stream — Moonlight-common-cMoonlight-stream — Moonlight EmbeddedMoonlight-stream — Moonlight SwitchMoonlight-stream — Moonlight TVMoonlight-stream — Moonlight VitaMoonlight-stream — Moonlight Xbox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-42799",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-42799",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-07T16:57:28.464944Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "moonlight-stream",
          "product": "moonlight-common-c",
          "versions": [
            {
              "status": "affected",
              "version": ">= 50c0a51b10ecc5b3415ea78c21d96d679e2288f9, < 02b7742f4d19631024bd766bd2bb76715780004e"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-14T17:15:07.257",
  "references": [
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/commit/02b7742f4d19631024bd766bd2bb76715780004e",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-r8cf-45f4-vf8m",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/commit/02b7742f4d19631024bd766bd2bb76715780004e",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/commit/50c0a51b10ecc5b3415ea78c21d96d679e2288f9",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-r8cf-45f4-vf8m",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 02b7742f4d19631024bd766bd2bb76715780004e."
    },
    {
      "lang": "es",
      "value": "Moonlight-common-c contiene el código principal del cliente GameStream compartido entre los clientes Moonlight. Moonlight-common-c es vulnerable al desbordamiento del búfer a partir de el commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 debido al uso absoluto de funciones C inseguras y a una verificación de los límites inadecuada. Un servidor de transmisión de juegos malicioso podría aprovechar una vulnerabilidad de desbordamiento del búfer para bloquear un cliente de luz nocturna o lograr la ejecución remota de código (RCE) en el cliente (con mitigaciones de explotación insuficientes o si se pueden evitar las mitigaciones). El error se solucionó en el commit 02b7742f4d19631024bd766bd2bb76715780004e."
    }
  ],
  "lastModified": "2026-06-17T06:24:32.183",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight-common-c:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE5D99F2-FFB5-4239-855B-2CDAE0210FE3",
              "versionEndExcluding": "2023-10-06",
              "versionStartIncluding": "2022-11-04"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "730ABEDB-A45B-487D-90E5-58188F33021E",
              "versionEndIncluding": "8.5.0",
              "versionStartIncluding": "8.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:tvos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8DC3BA3-941C-40D2-AD1B-AF7971D99672",
              "versionEndIncluding": "8.5.0",
              "versionStartIncluding": "8.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D8BB0A6-B219-4AFF-BE01-BC0546DAAF91",
              "versionEndIncluding": "11.0",
              "versionStartIncluding": "10.10"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight:0.10.22:*:*:*:*:chrome:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E50A8A78-8606-49DD-8D95-3AE7DFBA3E87"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight_embedded:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E1F448D-0CFE-4DAE-A119-8AF4F8FD48EF"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight_xbox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFE72448-E647-43F9-A72C-F86118596EE3",
              "versionEndIncluding": "1.14.40",
              "versionStartIncluding": "1.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight_tv:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38BDA766-E56D-496D-BC16-AD2026E04A7F",
              "versionEndIncluding": "1.5.27",
              "versionStartIncluding": "1.5.4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight_switch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FFADEE0-F587-4444-AE6F-323E20808042",
              "versionEndIncluding": "0.13.3",
              "versionStartIncluding": "0.13"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moonlight-stream:moonlight_vita:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFAF4088-233D-46FA-A031-ACCF0D7FF78F",
              "versionEndIncluding": "0.9.3",
              "versionStartIncluding": "0.9.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}