---
id: CVE-2026-50544
title: >-
  NortheBridge/luminalshine is a Sunshine-compatible game stream host for
  Moonlight
summary: >-
  NortheBridge/luminalshine is a Sunshine-compatible game stream host for
  Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default
  install, the file at `src/platform/windows/misc.cpp` lives at
  `C:\ProgramData\LuminalShine\…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-379
  - CWE-732
vendor: NortheBridge
product: luminalshine
affected:
  - luminalshine < 26.05.0-rc4
published: '2026-08-13'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50544'
references:
  - url: >-
      https://github.com/NortheBridge/luminalshine/security/advisories/GHSA-52q6-5x97-2747
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-14T22:23:37.675303Z'
ingestedAt: '2026-09-14T13:17:34.892Z'
epss: 0.00125
epssPercentile: 0.01867
---

## Overview

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.