Moonlight PC v6.2.0 Security Advisory: Fixes for CVE-2026-33546/547/41210 (Remote Crash)

Vulnerability Overview The following security vulnerabilities have been fixed in Moonlight PC v6.2.0: CVE-2026-33546 CVE-2026-33547 CVE-2026-41210 These vulnerabilities may allow a malicious host to crash Moonlight upon connection. Affected Scope All Windows, macOS, and Linux users running versions prior to Moonlight PC v6.2.0. Specifically, those connecting to Moonlight via Steam Link or other devices. Remediation Upgrade to Moonlight PC v6.2.0 or later. Ensure the latest version is downloaded and installed from official channels. For Windows users upgrading from v6.1.0 or earlier, delete the file to prevent crashes. POC Code or Exploit Code No specific POC code or exploit code was provided in this report. Other Important Information Behavioral Changes: - The default renderer on macOS has been changed to libplacebo (using MoltenVK). - Most video renderers now use full-range colors instead of limited range. - The cursor is now locked within the video area, applicable to single-monitor borderless window scenarios. - Game Mode has been re-enabled on macOS. - The Metal renderer supports Macs with dedicated GPUs. - HDR metadata is used for tone mapping on macOS. - CLI output on Windows is displayed in the console instead of a dialog box. - On non-x86 Linux platforms, GPUs are assumed to be slower, and certain optimizations are enabled by default. - Gamepad motion sensors have been disabled on Steam Link hardware to reduce audio glitches. - The default streaming resolution for new installations is now 1080p instead of 720p. - Video bitrate no longer resets when adjusting resolution or frame rate. New Features: - Added Ctrl+Alt+Shift+K to toggle system keyboard grab. - The D3D11 renderer has been updated to support VRR and improve performance. - The KMSDRM renderer has been rewritten to support atomic mode setting, overlays, VRR, ALLM, software decoding, V-sync, etc. - The Vulkan renderer now supports Linux without a desktop environment. - AV1 hardware decoding is now supported on macOS (M3 and newer). - AppImages now use system libraries to prevent hardware decoding failures. - Added support for DualSense adaptive triggers. - Gamepads can now be passed to the host (requires host support). - Client identifiers are now provided to the host to allow client-specific session management. - Added an option to disable pre-start warnings. - YUV 4:4:4 video is now supported by the DXVA2 renderer. - Raspberry Pi 2 and 3 are now officially supported. Bug Fixes: - Reduced background CPU usage. - Improved startup, settings page, and stream loading times. - Optimized performance of EGL/GLES renderers on low-end GPUs and embedded devices. - Fixed failures of EGL/GLES renderers under X11 when GLX is used for the UI. - Removed Windows Firewall service status checks. - Improved readability of the statistics overlay. - Improved timing accuracy within the statistics overlay. - Improved performance when multiple gamepads send input simultaneously. - Improved recovery performance from packet loss. - Improved DPI scaling behavior on Windows. - Fixed black or green bars at the bottom or right side of the video when streaming from certain hosts. - Fixed incorrect horizontal scroll direction upon request. - Fixed high video latency for H.264 codec on Raspberry Pi devices. - Fixed Moonlight not exiting after launching from CLI. - Fixed startup failure when desktop OpenGL is unavailable on Linux systems. - Fixed corrupted overlay rendering with proprietary drivers on PowerVR systems. - Fixed AV1 auto-selection on systems where HEVC is unavailable. - Fixed instability during VAAPI decoding under X11. - Fixed minor deviations in chroma crosstalk and color conversion. - Fixed the display of progress spinners and configuration transformations on KMSDRM. - Fixed GEM handle leaks that could cause streaming failures on KMSDRM. - Fixed suboptimal format selection on certain VA2 decoders. - Fixed handling of certain non-US keyboard layouts. - Fixed outdated API list display when using CLI commands. - Fixed unescaped IPv6 literals in non-URL contexts. - Fixed AV1 Vulkan video decoding on newer versions of FFmpeg. - Fixed Ctrl+C/SIGTERM handling when running from the console. - Prevented Bandicam Vulkan layer from loading into Moonlight and causing crashes. - Fixed missing stderr output in Steam Link logs. - Optimized Steam Link Opus decoder to reduce audio glitches. - Fixed several GUI interoperability issues on Qt 6.9 and later. - Fixed unexpected display of IME or software keyboard in various scenarios. - Fixed issues with running Wayland compositors when starting in a new VT. - Fixed focus movement issues when navigating from the game grid to the toolbar. - Fixed blurry overlays on the DXVA2 renderer. - Fixed scaling issues on the DXVA2 renderer on Intel systems. - Fixed potential crashes in the Vulkan renderer when overlays are disabled. - Added a workaround for libplacebo crashes on Raspberry Pi during hardware decoding. - Fixed keyboard shortcu

Goal Reached Thanks to every supporter — we hit 100%!

Moonlight PC v6.2.0 Security Advisory: Fixes for CVE-2026-33546/547/41210 (Remote Crash)

More from this source