{"id":"CVE-2025-10198","summary":"LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability","details":"Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.","modified":"2026-08-12T15:16:11.944233Z","published":"2025-09-09T17:28:14.696Z","database_specific":{"cna_assigner":"certcc","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10198.json"},"references":[{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/974249"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10198.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10198"},{"type":"FIX","url":"https://github.com/LizardByte/Sunshine/commit/9db11a906167bd962e57896223d7b9718058aeb2"},{"type":"FIX","url":"https://github.com/LizardByte/Sunshine/pull/3971"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lizardbyte/sunshine","events":[{"introduced":"64544e7960f5141f71438d72e5dedad81c03729c"},{"fixed":"9db11a906167bd962e57896223d7b9718058aeb2"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:lizardbyte:sunshine:2025.122.141614:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2025.122.141614"},{"last_affected":"2025.122.141614"}]}}],"versions":["2025.122.141614","v2025.122.141614"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/9db11a906167bd962e57896223d7b9718058aeb2","target":{"file":"src/main.cpp","function":"main"},"deprecated":false,"digest":{"function_hash":"173857910649550143340615180877149951341","length":6596},"id":"CVE-2025-10198-029d07ee","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["311497784284299362687893600935622322315","296237520580625570603371200251519921245","301519307986431331420288975825666489773","107318335586637839838753141760939448529"],"threshold":0.9},"id":"CVE-2025-10198-085081a8","signature_type":"Line","signature_version":"v1","source":"https://github.com/lizardbyte/sunshine/commit/9db11a906167bd962e57896223d7b9718058aeb2","target":{"file":"src/main.cpp"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10198.json","vanir_signatures_modified":"2026-08-12T15:16:11Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}