A DLL search-order hijacking vulnerability in LizardByte Sunshine for Windows, version v2025.122.141614, permits local attackers to achieve arbitrary code execution.

The software fails to properly restrict the search path for dynamically linked libraries. This allows an attacker with local access to place a malicious DLL into a directory within the application search path, leading to code execution when the application initializes.

The exploitation of this vulnerability results in a total compromise of the affected system, as the attacker can execute code with the privileges of the application process. With a CVSS score of 7.8, this flaw represents a significant risk to data integrity and system availability, potentially facilitating lateral movement within the network if the affected host is a critical workstation or server.

Immediate Action: Users should restrict write permissions on directories present in the system PATH to prevent unauthorized placement of malicious DLL files. Monitor vendor communication channels for the release of an official patch to address the underlying search path logic.

Proactive Monitoring: Security teams should monitor file integrity on system directories and audit the system PATH for unexpected or user-writable entries. Alerting on the execution of unsigned or suspicious DLLs loaded by the Sunshine process is recommended.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to detect and block unauthorized DLL loading attempts. Ensure that least-privilege principles are applied to user accounts to limit the ability to modify system-level paths.

Public Exploit Available: Unknown.

Given the potential for total system compromise, administrators should prioritize hardening the environment by restricting directory permissions for standard users. While a specific patch version remains unconfirmed in the provided data, users must track the LizardByte repository for updates and apply them immediately upon release to remediate the insecure path handling.