CVE-2026-59683 — OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings

CVE-2026-59683

OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings PUBLISHED

Description (CNA)

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).

Affected (CNA)

Vendor / product	Versions
CalcProgrammer1 / OpenRGB	affected 0 through 1.0rc3

CWE

CWE-73

References

https://bugzilla.suse.com/show_bug.cgi?id=1274007
https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.