What is the CVSS score of CVE-2025-54081?

CVE-2025-54081 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sunshine are affected by CVE-2025-54081?

Organizations using Sunshine should be aware of notable risk from CVE-2025-54081 rated CVSS 6.7. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-54081?

Yes, a public proof-of-concept exploit is available for CVE-2025-54081. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-54081?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Sunshine CVE-2025-54081

MEDIUM

Unquoted Search Path or Element (CWE-428)

2025-09-23 security-advisories@github.com

Microsoft Information Disclosure Sunshine Windows

6.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:13 vuln.today

Patch released

Mar 28, 2026 - 19:13 nvd

Patch available

PoC Detected

Oct 08, 2025 - 17:48 vuln.today

Public exploit code

CVE Published

Sep 23, 2025 - 19:15 nvd

MEDIUM 6.7

DescriptionGitHub Advisory

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.

AnalysisAI

Sunshine is a self-hosted game stream host for Moonlight. Rated medium severity (CVSS 6.7). Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-428. Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222. Affected products include: Lizardbyte Sunshine. Version information: version 2025.923.33222.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.