CVE-2025-54081 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

What is CVE-2025-54081?

CVE-2025-54081 is a medium-severity vulnerability in LizardByte Sunshine, published on 23 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

Weakness: CWE-428

Which versions are affected by CVE-2025-54081?

It affects 1 product.

Products include Lizardbyte Sunshine.

How do I fix CVE-2025-54081?

No fix has been published for CVE-2025-54081 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-54081 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54081 exists.

Other vulnerabilities in LizardByte Sunshine

• CVE-2026-32253 Sunshine: Authentication bypass via improper client certificate validation Critical 9.8
• CVE-2025-53095 Sunshine application-wide CSRF in the UI leads to command injection as Administrator Critical 9.7
• CVE-2025-10198 LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability High 7.8
• CVE-2025-10199 A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows High 7.8
• CVE-2024-51738 Sunshine improperly enforces pairing protocol request order High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6p7j-5v8v-w45h.