Executive Summary

This vulnerability involves the SunshineService Windows service being installed with an unquoted executable path. If the installation directory name contains spaces, the Windows Service Control Manager may misinterpret the path and execute a malicious binary placed earlier in the search path. This can allow an attacker to run unauthorized code.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to execute malicious code with the privileges of the SunshineService. This could lead to compromise of the system's confidentiality, integrity, and availability, potentially allowing unauthorized access, data manipulation, or disruption of service.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the SunshineService Windows service executable path is unquoted and contains spaces. On a Windows system, use the command: sc qc SunshineService and inspect the BINARY_PATH_NAME for unquoted paths with spaces. If the path is unquoted and includes spaces, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to update Sunshine to version 2025.923.33222 or later, where the unquoted service path issue is patched. Alternatively, ensure the service executable path is quoted properly or install Sunshine in a directory path without spaces to avoid exploitation.

Useful 0 Not Useful 0