Description

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T00:17:32.930Z",
  "pubdate": "2026-08-13T00:17:32.930Z",
  "executiveSummary": "A latent privilege escalation vulnerability exists in NortheBridge/luminalshine prior to version 26.05.0-rc4. The vulnerability involves the handling of a configuration file created by a SYSTEM-level service within the ProgramData directory structure. While the file at src/platform/windows/misc.cpp is initialized by privileged components, the underlying security implications stem from potential misconfigurations or assumptions regarding Windows Discretionary Access Control Lists (DACLs) and file permission inheritance. Under default Windows configurations, C:\\ProgramData grants BUILTIN\\Users Read and Execute permissions, preventing standard users from modifying files protected by default inheritance rules, meaning the canonical Elevation of Privilege condition does not trivially trigger on a vanilla installation without modified permission states. If exploited through improper access control enforcement, an attacker with local access could potentially manipulate configuration data to execute arbitrary code with elevated privileges. The vulnerability is resolved in version 26.05.0-rc4, and administrators can apply workarounds by enforcing default condition DACLs for the ProgramData directory.",
  "technicalDetails": "The vulnerability resides within the Windows platform-specific implementation of NortheBridge/luminalshine, specifically located in src/platform/windows/misc.cpp. The core component affected is the file initialization and management routine for C:\\ProgramData\\LuminalShine\\config\\apps.json, which is instantiated and maintained by a background service running under the context of the NT AUTHORITY\\SYSTEM account.\nFrom a root cause perspective, the security posture relies heavily on the integrity and permission boundaries of the filesystem path where the application configuration resides. Under default Windows operating system configurations, the C:\\ProgramData directory enforces inherited DACLs that typically restrict write access for the BUILTIN\\Users group, granting only Read and Execute rights. Consequently, on a vanilla, out-of-the-box Windows installation, standard unprivileged users cannot directly modify apps.json, thereby neutralizing the canonical local Elevation of Privilege (EoP) vector.\nHowever, if the deployment environment features weakened directory permissions, custom DACL modifications, or inheritance breaks that grant write or modify permissions to lower-privileged security principals, the vulnerability becomes actionable. An attacker with local access and standard user privileges could leverage this exposure to overwrite or manipulate the apps.json configuration file. Because the file is consumed by a privileged SYSTEM service, tampering with its contents could lead to unintended command execution, arbitrary binary loading, or parameter injection when the service parses or executes entries defined within the configuration.\nThe attack flow typically requires an adversary to possess local interactive or programmatic access to the host system. The attacker first verifies the permission states of the C:\\ProgramData\\LuminalShine\\ config directory and the apps.json file. If write permissions are improperly assigned to non-administrative users, the attacker crafts a malicious payload or modifies execution parameters within apps.json. Upon subsequent interaction with the LuminalShine host or service restart, the privileged component parses the compromised configuration file, resulting in the execution of arbitrary commands or binaries in the context of the SYSTEM security context. The affected versions comprise all releases of NortheBridge/luminalshine prior to version 26.05.0-rc4. Network exposure is non-existent as the attack vector is strictly local, requiring no authentication credentials beyond local system access, but depending entirely on local privilege boundaries and misconfigured file system ACLs."
}