Skip to main content

Sunshine CVE-2025-10199

HIGH
Unquoted Search Path or Element (CWE-428)
2025-09-09 cret@cert.org
Microsoft Privilege Escalation Sunshine Windows
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 19:11 vuln.today
CVE Published
Sep 09, 2025 - 18:15 nvd
HIGH 7.8

DescriptionCVE.org

A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.

AnalysisAI

A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-428. A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. Affected products include: Lizardbyte Sunshine.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sunshine

View all
CVE-2025-54081 MEDIUM POC
6.7 Sep 23

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 6.7). Public exploit code availabl
CVE-2024-31221 MEDIUM POC
5.9 Apr 08

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 5.9), this vulnerability is remote
CVE-2026-32253 CRITICAL
9.8 May 22

Authentication bypass in LizardByte Sunshine self-hosted game stream host (versions prior to 2026.516.143833) allows rem
CVE-2025-53095 CRITICAL
9.6 Jul 01

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks p
CVE-2024-45407 MEDIUM POC
5.3 Sep 10

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 5.3), this vulnerability is remote
CVE-2024-31220 HIGH
7.3 Apr 05

Sunshine is a self-hosted game stream host for Moonlight. Rated high severity (CVSS 7.3), this vulnerability is remotely
CVE-2025-53096 MEDIUM
5.4 Jul 01

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks p
CVE-2024-31226 LOW
2.9 May 16

Sunshine is a self-hosted game stream host for Moonlight. Rated low severity (CVSS 2.9).
CVE-2025-10198 HIGH
7.8 Sep 09

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers

CVE-2024-51738 HIGH
7.7 Jan 20

Sunshine is a self-hosted game stream host for Moonlight. Rated high severity (CVSS 7.7), this vulnerability is remotely

Same weakness CWE-428 – Unquoted Search Path or Element

View all
CVE-2022-50935 CRITICAL POC
9.8
CVE-2023-38408 CRITICAL POC
9.8
CVE-2025-71326 HIGH POC
8.5
CVE-2016-20090 HIGH POC
8.5
CVE-2016-20089 HIGH POC
8.5
CVE-2020-37252 HIGH POC
8.5
CVE-2023-54353 HIGH POC
8.5
CVE-2020-37254 HIGH POC
8.5

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2025-10199 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy