CVE-2026-59683CWE-73

CVE-2026-59683

Critical · published August 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-26T14:16Z
References (2)
https://bugzilla.suse.com/show_bug.cgi?id=1274007 · [email protected]https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:47Z
    EPSS moved — → 1%
    epss
  • 26 AUG 09:24Z
    OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
    cvelistv5