LizardByte Sunshine vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Latest LizardByte Sunshine vulnerabilities

CVE-2026-111044 — Disabled Sunshine clients can bypass revocation with a derived client certificate (CVSS 7.6)
CVE-2026-32253 — Sunshine: Authentication bypass via improper client certificate validation (CVSS 9.8)
CVE-2025-54081 — SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution (CVSS 7.0)
CVE-2025-10199 — A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows (CVSS 7.8)
CVE-2025-10198 — LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability (CVSS 7.8)
CVE-2025-53096 — Sunshine clickjacking in the UI leads to unauthorized actions being performed (CVSS 6.1)
CVE-2025-53095 — Sunshine application-wide CSRF in the UI leads to command injection as Administrator (CVSS 8.8)
CVE-2024-51738 — Sunshine improperly enforces pairing protocol request order (CVSS 8.1)
CVE-2024-45407 — Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client (CVSS 5.3)
CVE-2024-31226 — Sunshine's unquoted executable path could lead to hijacked execution flow (CVSS 2.9)
CVE-2024-31221 — Clients removed during unpairing process may regain access if Sunshine was not restarted (CVSS 5.9)
CVE-2024-31220 — Sunshine vulnerable to remote unauthenticated arbitrary file read (CVSS 7.3)