CVE-2025-54081
BaseFortify
Publication date: 2025-09-23
Last updated on: 2025-10-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lizardbyte | sunshine | From 0.10.0 (inc) to 2025.923.33222 (exc) |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the SunshineService Windows service being installed with an unquoted executable path. If the installation directory name contains spaces, the Windows Service Control Manager may misinterpret the path and execute a malicious binary placed earlier in the search path. This can allow an attacker to run unauthorized code.
How can this vulnerability impact me? :
An attacker could exploit this vulnerability to execute malicious code with the privileges of the SunshineService. This could lead to compromise of the system's confidentiality, integrity, and availability, potentially allowing unauthorized access, data manipulation, or disruption of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the SunshineService Windows service executable path is unquoted and contains spaces. On a Windows system, use the command: sc qc SunshineService and inspect the BINARY_PATH_NAME for unquoted paths with spaces. If the path is unquoted and includes spaces, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update Sunshine to version 2025.923.33222 or later, where the unquoted service path issue is patched. Alternatively, ensure the service executable path is quoted properly or install Sunshine in a directory path without spaces to avoid exploitation.