Loading story…
A public security disclosure detailed multiple severe vulnerabilities in OpenRGB’s custom TCP server protocol on port 6742, warning that affected systems can be exposed to arbitrary file overwrite, denial of service, and full local or remote root compromise. The issues stem from missing authentication, weak input validation, and, in affected 1.0 release candidates, default network exposure on 0.0.0.0, which can leave the service reachable to remote attackers if firewalls do not block access. Researchers said the most serious risk appears when the daemon runs as root, a configuration reinforced by a systemd service introduced in 1.0rc2.
The disclosure assigns CVE-2026-59682 to arbitrary file overwrite and deletion through profile operations, CVE-2026-59683 to privilege escalation and remote root compromise by combining writable profile paths with attacker-controlled profile content, and CVE-2026-18794 to broader denial-of-service and memory-corruption bugs. OpenRGB 1.0rc1 and later release candidates are reported as fully affected, while stable 0.9 and older versions remain vulnerable to local symlink-based privilege escalation and remote DoS but not the simplest remote-root path. Upstream released 1.0rc3-hotfix with partial mitigations including localhost-only default binding, pathname restrictions, service hardening, and message-size limits, but the researchers said they still do not recommend running OpenRGB on real networks.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On August 25, 2026, Matthias Gerstner published a security report disclosing multiple OpenRGB vulnerabilities, including CVE-2026-59682, CVE-2026-59683, and CVE-2026-18794. The report described arbitrary file overwrite and deletion, denial of service, and local or remote root compromise risks in OpenRGB's custom TCP protocol.
Adam Honse committed a change to NetworkServer.cpp that used explicit received packet and payload lengths when constructing strings for profile save, load, delete, and client-string requests. The change replaced null-terminated buffer handling, preventing parsing from extending beyond the received network payload.
Upstream released version 1.0rc3-hotfix with a localhost-only default listener, pathname restrictions, service hardening, and maximum message size limits. The report characterizes these as minimal or partial mitigations and still advises against running OpenRGB on real networks.
The public report says a systemd service introduced in 1.0rc2 ran OpenRGB server mode as root, increasing the impact of the protocol flaws when exposed on the network.
The disclosed report states that OpenRGB release candidates starting with 1.0rc1 are fully affected by the vulnerable network protocol behavior, including the trivial remote root exploit path present in newer release candidates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesecurity.opensuse.org
Open sourcegitlab.com
Open sourcegitlab.com
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenRGB 1.0 has been released as a GPLv2-licensed, cross-platform C/C++ application for managing RGB hardware without vendor-specific software. The release supports 2,551 devices across motherboards, memory, GPUs, peripherals, controllers, and smart-lighting products; it also adds HID hot-plug handling, JSON-based profiles, and SDK/protocol improvements, while replacing the Windows `WinRing0` driver dependency with Pawnio. The release addresses **CVE-2026-59682** and **CVE-2026-59683** in OpenRGB protocol handling. Crafted `SAVE_PROFILE` requests could exploit path traversal to write files outside intended locations, while combined `UPDATEMODE` and `SAVE_PROFILE` commands could overwrite arbitrary files if OpenRGB runs with root privileges. openSUSE packages already include fixes; organizations should update OpenRGB deployments and avoid running its SDK server with elevated privileges unless necessary.
Sep 12, 2026
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026
X.Org disclosed **nine security vulnerabilities** in the X server and Xwayland and released fixes in **`xorg-server 21.1.23`** and **`xwayland 24.1.12`**. The bugs, later assigned **`CVE-2026-50256`** through **`CVE-2026-50264`**, affect versions prior to those releases and span multiple subsystems including **libXfont2/font alias handling, XSYNC, XKB, GLX, screensaver code, and DRI2**. Reported impacts include crashes, information disclosure, memory corruption, and possible **privilege escalation** where the X server runs as root; some reports also note potential **remote code execution** exposure in environments using **SSH X11 forwarding**. Most issues were reported by an anonymous researcher working with TrendAI Zero Day Initiative, while one DRI2 flaw was credited to Peter Hutterer of Red Hat. The fixes address several distinct bug classes: a **stack-based buffer overflow** caused by a font-name length mismatch during alias resolution, multiple **use-after-free** conditions in XSYNC object teardown and `CreateSaverWindow`, stricter GLX request-size validation to stop malformed client requests from reaching unsafe paths, and DRI2 hardening to validate and deduplicate buffer attachments before allocation and processing. One disclosed flaw, tracked as **`CVE-2026-50256`**, allows any client able to connect to the server to trigger a font-alias overflow that could lead to denial of service or elevated impact on root-run servers. Red Hat separately rated affected X.Org server packages as **Important** across supported RHEL releases, underscoring the need to update exposed X.Org and Xwayland deployments.
Jun 29, 2026