← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-6hh9-gpj4-cr69: Coordinated Vulnerability Disclosure Verification Record (moonlight-stream/moonlight-common-c)

[CONFIRMED & PATCHED UPSTREAM / FIX PR #168 MERGED INTO MASTER]
Reported to moonlight-stream/moonlight-common-c via GitHub Security Advisory (GHSA-6hh9-gpj4-cr69) and patched upstream in Pull Request moonlight-stream/moonlight-common-c#168 (Fix missing IDX_DS_ADAPTIVE_TRIGGERS sentinel in packetTypesGen3..7 in src/ControlStream.c).
Reviewed and merged into master by lead maintainer Cameron Gutman (@cgutman) on 2026-10-26T22:46:49Z (commit 6a2f158e88).

0x00 // GitHub CNA & Upstream Patch Metadata

{
  "ghsa_id": "GHSA-6hh9-gpj4-cr69",
  "repository": "moonlight-stream/moonlight-common-c",
  "html_url": "https://github.com/moonlight-stream/moonlight-common-c/security/advisories/GHSA-6hh9-gpj4-cr69",
  "upstream_fix_pr": "https://github.com/moonlight-stream/moonlight-common-c/pull/168",
  "upstream_merge_commit": "https://github.com/moonlight-stream/moonlight-common-c/commit/6a2f158e882a23f040b913bc96a718df7688d656",
  "merged_by": "cgutman (Cameron Gutman)",
  "merged_at": "2026-10-26T22:46:49Z",
  "summary": "Out-of-Bounds Read (CWE-125) and Uninitialized Memory Usage (CWE-908) in ControlStream Packet Dispatch (src/ControlStream.c)",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "status": "Confirmed & Patched Upstream in master (PR #168)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-125",
    "CWE-908"
  ]
}