CVE-2025-10198

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.

Score

CVSS 3.1 7.8 High

Status

Modified - cret@cert.org

Published

2025-09-09

Last modified

2026-01-20

Weaknesses

CWE-427

Affected products

• Sunshine (Lizardbyte)
• Sunshine For Windows (Lizardbyte)

References

• https://github.com/LizardByte/Sunshine/commit/9db11a906167bd962e57896223d7b9718058aeb2
• https://github.com/LizardByte/Sunshine/pull/3971
• https://www.kb.cert.org/vuls/id/974249