CVE-2025-54081
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-23

Last updated on: 2025-10-08

Assigner: GitHub, Inc.

Description
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-23
Last Modified
2025-10-08
Generated
2026-05-07
AI Q&A
2025-09-23
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
lizardbyte sunshine From 0.10.0 (inc) to 2025.923.33222 (exc)
microsoft windows *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-428 The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves the SunshineService Windows service being installed with an unquoted executable path. If the installation directory name contains spaces, the Windows Service Control Manager may misinterpret the path and execute a malicious binary placed earlier in the search path. This can allow an attacker to run unauthorized code.


How can this vulnerability impact me? :

An attacker could exploit this vulnerability to execute malicious code with the privileges of the SunshineService. This could lead to compromise of the system's confidentiality, integrity, and availability, potentially allowing unauthorized access, data manipulation, or disruption of service.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

You can detect this vulnerability by checking if the SunshineService Windows service executable path is unquoted and contains spaces. On a Windows system, use the command: sc qc SunshineService and inspect the BINARY_PATH_NAME for unquoted paths with spaces. If the path is unquoted and includes spaces, the system is vulnerable.


What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation is to update Sunshine to version 2025.923.33222 or later, where the unquoted service path issue is patched. Alternatively, ensure the service executable path is quoted properly or install Sunshine in a directory path without spaces to avoid exploitation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart