CVE-2026-50544

The record

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.

Affected packages

Related vulnerabilities

• CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPGA… CWE-379
• CVE-2026-82346 A potential security vulnerability has been identified in the HP ImageDiags for versions… CWE-379
• CVE-2026-46388 osquery is a SQL powered operating system instrumentation, monitoring, and analytics… CWE-379
• CVE-2026-7539 A potential security vulnerability has been identified in the HP Accessory WMI Provider… CWE-379
• CVE-2026-54328 Pi is a minimal terminal coding harness. CWE-379
• GHSA-jfgx-wxx8-mp94 Pi Agent: Predictable temporary extension install paths allow local privilege escalation… CWE-379
• CVE-2026-42191 OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol)… CWE-379
• CVE-2019-25677 WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to… CWE-379