CVE-2026-50544 Overview
CVE-2026-50544 affects NortheBridge LuminalShine, a Sunshine-compatible game stream host for Moonlight clients. The vulnerability involves insecure handling of a configuration file created by a SYSTEM service under C:\ProgramData\LuminalShine\config\apps.json. The file path referenced in src/platform/windows/misc.cpp inherits Windows default C:\ProgramData access control lists (ACLs), which grant BUILTIN\Users Read+Execute rights only. Versions prior to 26.05.0-rc4 contain the latent gap. The maintainers released version 26.05.0-rc4 to remediate the issue. The vulnerability is categorized under [CWE-379] (Creation of Temporary File in Directory with Insecure Permissions).
Critical Impact
A local attacker who alters the default ProgramData DACLs could achieve elevation of privilege by tampering with a configuration file loaded by a SYSTEM-level service.
Affected Products
- NortheBridge LuminalShine prior to 26.05.0-rc4
- Windows installations where default C:\ProgramData DACLs have been modified
- Sunshine-compatible game stream host deployments running as SYSTEM
Discovery Timeline
- 2026-08-13 - CVE-2026-50544 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-50544
Vulnerability Analysis
LuminalShine runs a Windows service under the SYSTEM account and reads application configuration from C:\ProgramData\LuminalShine\config\apps.json. The path is referenced in src/platform/windows/misc.cpp and is created by the service at runtime. A file writable by a lower-privileged user but consumed by a SYSTEM process presents a canonical local elevation of privilege pattern. On a vanilla Windows install, default C:\ProgramData inheritance grants BUILTIN\Users only Read and Execute permissions, which prevents the low-privileged user from modifying apps.json. The gap is therefore latent and depends on non-default DACL configurations.
Root Cause
The root cause is the reliance on directory-inherited access control instead of explicit, restrictive DACLs on the configuration file created by the SYSTEM service. If an administrator or third-party installer weakens C:\ProgramData permissions, apps.json becomes writable by standard users while still being executed in SYSTEM context.
Attack Vector
Exploitation requires local access, high privileges to alter DACLs or a pre-existing weakened DACL state, and user interaction to trigger the service load path. A local attacker on a system with non-default ProgramData permissions could overwrite apps.json with malicious command entries. When LuminalShine parses the file and launches a configured application, it does so with SYSTEM privileges. This yields elevation of privilege from a standard user to SYSTEM.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-52q6-5x97-2747 for technical details.
Detection Methods for CVE-2026-50544
Indicators of Compromise
- Unexpected modifications to C:\ProgramData\LuminalShine\config\apps.json by non-administrative users
- New or altered command lines in apps.json invoking uncommon binaries, PowerShell, or cmd.exe
- Child processes of the LuminalShine service running as SYSTEM and executing user-controlled payloads
Detection Strategies
- Audit DACLs on C:\ProgramData\LuminalShine and confirm they match Windows default inheritance for ProgramData
- Enable Windows object access auditing (Event ID 4663) on apps.json to record write attempts by non-privileged principals
- Alert on process creation events (Event ID 4688) where a LuminalShine SYSTEM process spawns interpreters or unsigned binaries
Monitoring Recommendations
- Track file integrity of apps.json and compare hashes against a known-good baseline after upgrades
- Monitor service account activity for anomalous child process trees originating from the LuminalShine host
- Correlate DACL changes on C:\ProgramData subdirectories with subsequent service restarts
How to Mitigate CVE-2026-50544
Immediate Actions Required
- Upgrade LuminalShine to version 26.05.0-rc4 or later, which contains the patch
- Verify that C:\ProgramData and C:\ProgramData\LuminalShine retain default Windows DACLs
- Remove any non-default access control entries granting write access to BUILTIN\Users on the configuration directory
Patch Information
The fix is available in LuminalShine version 26.05.0-rc4. Review the GitHub Security Advisory GHSA-52q6-5x97-2747 for the patched commit and release notes.
Workarounds
- Restore default DACLs on C:\ProgramData if they have been modified by installers or administrators
- Explicitly restrict write access on C:\ProgramData\LuminalShine\config\apps.json to SYSTEM and Administrators
- Restrict local logon on hosts running the LuminalShine service to trusted administrators until patching is complete
# Verify DACLs on the LuminalShine configuration directory
icacls C:\ProgramData\LuminalShine
# Reset to inherited defaults if DACLs were modified
icacls C:\ProgramData\LuminalShine /reset /T /C
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
