VULNERABILITY INTELLIGENCE

CVE-2025-54081

CVSS score6.7 MEDIUM

EPSS probability0.23%

CISA KEVNot currently listed

Published2025-09-23

Last modified2026-10-11

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

Weakness classification

CWE-428: Unquoted Search Path or Element

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Release Notes
security-advisories@github.com — Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory