A local privilege escalation vulnerability in LizardByte Sunshine for Windows poses a significant risk to system integrity by allowing low-privileged users to gain administrative control.

The application utilizes an unquoted service path, which is a flaw where the system search path for an executable is not properly delimited. This allows an authenticated low-privileged attacker to place a malicious executable in a parent directory, which the service will then execute with elevated privileges.

Successful exploitation of this vulnerability grants an attacker full administrative access to the affected Windows host. This facilitates complete system compromise, including the ability to install persistent backdoors, exfiltrate sensitive data, or disrupt business operations, justifying the high CVSS score of 7.8.

Immediate Action: Administrators should review the official LizardByte GitHub security advisory for the latest version and apply the recommended update as soon as it is released.

Proactive Monitoring: Monitor system logs for the creation of unexpected executable files within the service installation directory or any parent directories in the system search path.

Compensating Controls: Ensure that directory permissions are strictly enforced on the affected installation path to prevent unauthorized users from creating or modifying files in those locations.

Public Exploit Available: No (exploit_available: unknown).

Given the potential for full system compromise, this vulnerability represents a high-priority risk for Windows environments hosting the Sunshine service. Organizations should verify their current deployment version immediately and restrict local user permissions on the installation directory until a vendor-supplied patch can be implemented.