CVE-2025-54081

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824	Patch
https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222	Release Notes
https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h	Exploit Vendor Advisory
https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Sunshine es un anfitrión de transmisión de juegos autoalojado para Moonlight. Antes de la versión 2025.923.33222, el servicio de Windows SunshineService se instala con una ruta de ejecutable sin comillas. Si Sunshine se instala en un directorio cuyo nombre incluye un espacio, el Administrador de Control de Servicios (SCM) interpreta la ruta de forma incremental y puede ejecutar un binario malicioso colocado antes en la cadena de búsqueda. Este problema ha sido parcheado en la versión 2025.923.33222.

Information

Published : 2025-09-23 19:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-54081

Mitre link : CVE-2025-54081

CVE.ORG link : CVE-2025-54081

JSON object : View

Products Affected

microsoft

windows

lizardbyte

sunshine

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2025-54081", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54081", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T19:15:27.573785Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "LizardByte", "product": "Sunshine", "versions": [{"status": "affected", "version": "< 2025.923.33222"}]}]}], "published": "2025-09-23T19:15:39.963", "references": [{"url": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222."}, {"lang": "es", "value": "Sunshine es un anfitri\u00f3n de transmisi\u00f3n de juegos autoalojado para Moonlight. Antes de la versi\u00f3n 2025.923.33222, el servicio de Windows SunshineService se instala con una ruta de ejecutable sin comillas. Si Sunshine se instala en un directorio cuyo nombre incluye un espacio, el Administrador de Control de Servicios (SCM) interpreta la ruta de forma incremental y puede ejecutar un binario malicioso colocado antes en la cadena de b\u00fasqueda. Este problema ha sido parcheado en la versi\u00f3n 2025.923.33222."}], "lastModified": "2026-10-11T20:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBAEB372-589D-4C6A-A10B-1D654BB16BB9", "versionEndExcluding": "2025.923.33222", "versionStartIncluding": "0.10.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-advisories@github.com"}