High-Severity Flaws in Sunshine for Windows Allow Privilege Escalation

According to CERT Coordination Center (CERT/CC), two critical local security flaws affect Sunshine for Windows v2025.122.141614 (and likely earlier versions) that could lead to privilege escalation and arbitrary code execution. The flaws are CVE-2025-10198 (CVSS 7.5) for Unquoted Service Path and CVE-2025-10199 (CVSS 7.8) for DLL Search-Order Hijacking in Sunshine, a self-hosted game streaming host for Moonlight.

CERT/CC explains that Unquoted Service Path could allow an attacker with local access to place a malicious executable in a directory within the service path, which could then be executed with elevated privileges during system startup or service restart; DLL Search-Order Hijacking could enable an attacker to place a malicious DLL in a user-writable directory included in the PATH, leading to arbitrary code execution when the application loads.

The advisories state that attackers with local access could escalate to SYSTEM privileges or execute code in the context of the running user, posing serious risks to Windows users of Sunshine. CERT/CC advises applying patches from the Sunshine project when available and implementing mitigations such as quoting service paths and restricting permissions on service-related directories.