CVE-2025-54081: Lizardbyte Sunshine

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

Affected products

• Lizardbyte Sunshine: from 0.10.0, before 2025.923.33222 (fixed in 2025.923.33222)

Published 2025-09-23. Last modified 2026-06-17.