LizardByte vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20256
3. 20262

Newest CVEs

• CVE-2026-111044

  Disabled Sunshine clients can bypass revocation with a derived client certificate

  LizardByte · Sunshine

  High7.6
• CVE-2026-32253

  Sunshine: Authentication bypass via improper client certificate validation

  LizardByte · Sunshine

  Critical9.8
• CVE-2025-54081

  SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

  LizardByte · Sunshine

  Medium6.7
• CVE-2025-10199

  A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows

  LizardByte · Sunshine for Windows

  High7.8
• CVE-2025-10198

  LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability

  LizardByte · Sunshine for Windows

  High7.8
• CVE-2025-53095

  Sunshine application-wide CSRF in the UI leads to command injection as Administrator

  LizardByte · Sunshine

  Critical9.7
• CVE-2025-53096

  Sunshine clickjacking in the UI leads to unauthorized actions being performed

  LizardByte · Sunshine

  Medium5.4
• CVE-2024-51738

  Sunshine improperly enforces pairing protocol request order

  LizardByte · Sunshine

  High7.7
• CVE-2024-45407

  Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

  LizardByte · Sunshine

  Medium6.5
• CVE-2024-31226

  Sunshine's unquoted executable path could lead to hijacked execution flow

  LizardByte · Sunshine

  Medium4.9