CVE-2026-50544
Received Received - Intake

Privilege Escalation in LuminalShine Game Stream Host

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-50544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
northebridge luminalshine to 26.05.0-rc4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50544 is a vulnerability in NortheBridge/luminalshine versions before 26.05.0-rc4. It involves incorrect permission assignment for a critical file, apps.json, created by the SYSTEM service in C:\ProgramData\LuminalShine\config\. Default permissions only grant Read+Execute to BUILTIN\Users, but the lack of explicit permission enforcement allows potential write access under non-standard conditions. This could enable an attacker to modify the file and escalate privileges.

Detection Guidance

Check file permissions on C:\ProgramData\LuminalShine\config\apps.json. Ensure BUILTIN\Users only has Read+Execute. Verify no unexpected write access exists. Use icacls "C:\ProgramData\LuminalShine\config\apps.json" to inspect permissions.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to gain Administrator privileges. The attacker could read elevated commands and launch processes via CreateProcessAsUserW, leading to full system compromise. However, exploitation requires non-default conditions like modified ProgramData permissions or pre-created directories.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it requires local access, high privileges, and user interaction with high complexity. It primarily affects system integrity and confidentiality through potential privilege escalation.

Mitigation Strategies

Upgrade to version 26.05.0-rc4 or later. Ensure default DACLs for ProgramData are applied. Remove any pre-created directories or manual copies that grant write access to BUILTIN\Users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart