CVE-2025-54081
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code with service privileges, potentially leading to system compromise or privilege escalation.
Recommendation
It is recommended to immediately update Sunshine to version 2025.923.33222 or later, and also check if the installation path contains spaces.
Other vulnerabilities in Sunshine
See all- CVE-2026-111044High
Sunshine from 2026.329.165800 until 2026.906.222525 accepted any client certificate that chained to a stored paired-client certificate, without requiring the presented certificate to be the exact enabled paired identity. Certificate text was compared without canonicalizing equivalent PEM encodings, allowing a previously paired client to bypass the Disable control.
- CVE-2026-32253Critical
In Sunshine, a self-hosted game stream host for Moonlight, versions prior to 2026.516.143833, client-certificate authentication can be bypassed due to how OpenSSL verification results are handled. The custom verify callback treats some errors as success, allowing untrusted certificates.
Original NVD description (English source)
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS