CVE-2025-54081

HIGH EPSS 11.6%
Published Sep 23, 20259mo ago · Modified Jun 17, 20261w ago
7.0 CVSS 3.1
High
Find Similar
Published Sep 23, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

CVSS Details

Base Score
7.0
Exploitability
1.0
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
11.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-428

Affected Products 2

VendorProductVersionRange
lizardbytesunshine*≥0.10.0  –  <2025.923.33222
microsoftwindows*any

References 3

  • github.com https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824
    Patch
  • github.com https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222
    Release Notes
  • github.com https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824
    Patch