CVE-2025-54081 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager SCM interprets the path...

CVE-2025-54081 SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager SCM interprets the path...

CVE-2025-54081

CVE-2025-54081 affects Sunshine (Moonlight host) due to an unquoted executable path in the Windows service SunshineService prior to 2025.923.33222. If Sunshine is installed in a directory with spaces, the Service Control Manager may misinterpret the path and allow a malicious binary to execute ea...