CVE-2025-54081
MEDIUMDescription
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
Is your site exposed to CVE-2025-54081?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| lizardbyte | sunshine |
| microsoft | windows |
References
Advisories & Patches
Exploits
Other References
Frequently Asked Questions
What is CVE-2025-54081? +
How severe is CVE-2025-54081? +
What products are affected by CVE-2025-54081? +
How do I check if I'm vulnerable to CVE-2025-54081? +
Related Vulnerabilities
The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has …
The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker …
The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a …
The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path. This allows a local attacker with write …
An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. …
An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted …