Loading story…
OpenRGB 1.0 has been released as a GPLv2-licensed, cross-platform C/C++ application for managing RGB hardware without vendor-specific software. The release supports 2,551 devices across motherboards, memory, GPUs, peripherals, controllers, and smart-lighting products; it also adds HID hot-plug handling, JSON-based profiles, and SDK/protocol improvements, while replacing the Windows WinRing0 driver dependency with Pawnio.
The release addresses CVE-2026-59682 and CVE-2026-59683 in OpenRGB protocol handling. Crafted SAVE_PROFILE requests could exploit path traversal to write files outside intended locations, while combined UPDATEMODE and SAVE_PROFILE commands could overwrite arbitrary files if OpenRGB runs with root privileges. openSUSE packages already include fixes; organizations should update OpenRGB deployments and avoid running its SDK server with elevated privileges unless necessary.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Updated openSUSE OpenRGB packages incorporated fixes for CVE-2026-59682, which permits path traversal and arbitrary file writes through SAVE_PROFILE, and CVE-2026-59683, which can enable arbitrary file overwrites via UPDATEMODE and SAVE_PROFILE when OpenRGB runs with root privileges.
The OpenRGB project released version 1.0, a GPLv2-licensed cross-platform RGB-device control application for Linux, macOS, and Windows. The release adds support for 2,551 devices and introduces changes including Pawnio on Windows, HID hot-plug handling, JSON profiles, and SDK improvements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public security disclosure detailed multiple severe vulnerabilities in OpenRGB’s custom TCP server protocol on port `6742`, warning that affected systems can be exposed to arbitrary file overwrite, denial of service, and full local or remote root compromise. The issues stem from missing authentication, weak input validation, and, in affected 1.0 release candidates, default network exposure on `0.0.0.0`, which can leave the service reachable to remote attackers if firewalls do not block access. Researchers said the most serious risk appears when the daemon runs as root, a configuration reinforced by a systemd service introduced in `1.0rc2`. The disclosure assigns **CVE-2026-59682** to arbitrary file overwrite and deletion through profile operations, **CVE-2026-59683** to privilege escalation and remote root compromise by combining writable profile paths with attacker-controlled profile content, and **CVE-2026-18794** to broader denial-of-service and memory-corruption bugs. OpenRGB `1.0rc1` and later release candidates are reported as fully affected, while stable `0.9` and older versions remain vulnerable to local symlink-based privilege escalation and remote DoS but not the simplest remote-root path. Upstream released **`1.0rc3-hotfix`** with partial mitigations including localhost-only default binding, pathname restrictions, service hardening, and message-size limits, but the researchers said they still do not recommend running OpenRGB on real networks.
Aug 27, 2026
X.Org disclosed **nine security vulnerabilities** in the X server and Xwayland and released fixes in **`xorg-server 21.1.23`** and **`xwayland 24.1.12`**. The bugs, later assigned **`CVE-2026-50256`** through **`CVE-2026-50264`**, affect versions prior to those releases and span multiple subsystems including **libXfont2/font alias handling, XSYNC, XKB, GLX, screensaver code, and DRI2**. Reported impacts include crashes, information disclosure, memory corruption, and possible **privilege escalation** where the X server runs as root; some reports also note potential **remote code execution** exposure in environments using **SSH X11 forwarding**. Most issues were reported by an anonymous researcher working with TrendAI Zero Day Initiative, while one DRI2 flaw was credited to Peter Hutterer of Red Hat. The fixes address several distinct bug classes: a **stack-based buffer overflow** caused by a font-name length mismatch during alias resolution, multiple **use-after-free** conditions in XSYNC object teardown and `CreateSaverWindow`, stricter GLX request-size validation to stop malformed client requests from reaching unsafe paths, and DRI2 hardening to validate and deduplicate buffer attachments before allocation and processing. One disclosed flaw, tracked as **`CVE-2026-50256`**, allows any client able to connect to the server to trigger a font-alias overflow that could lead to denial of service or elevated impact on root-run servers. Red Hat separately rated affected X.Org server packages as **Important** across supported RHEL releases, underscoring the need to update exposed X.Org and Xwayland deployments.
Jun 29, 2026
X.Org released security updates for **X.Org Server 21.1.24**, **Xwayland 24.1.13**, and **libXfont2 2.0.8** to address five vulnerabilities tied largely to malformed **PCF fonts** and unsafe graphics context handling. The X server and Xwayland fixes cover **CVE-2026-55999**, a heap buffer overflow in glamor font atlas handling that an authenticated X client can trigger with a crafted PCF font on glamor-backed servers, and **CVE-2026-56000**, a use-after-free in `CommonMakeCurrent()` involving GLX `contextTags` that can be reached through malicious GLX context creation and `MakeCurrent` requests. The libXfont2 update fixes **CVE-2026-56001**, an integer-overflow-driven heap buffer overflow in `BitmapScaleBitmaps()`; **CVE-2026-56002**, a heap buffer overflow in `pcfReadFont()` during PCF parsing; and **CVE-2026-56003**, a heap buffer overflow in `ComputeScaledProperties()` caused by an unchecked fixed-size property buffer. X.Org said the flaws were reported anonymously through Trend Micro's **Zero Day Initiative**, and downstream reporting warned the bugs could enable privilege escalation or potentially remote code execution where the X server runs as root or where X11 forwarding is exposed over SSH.
Jul 12, 2026