CVE-2026-18794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18794
Published
2026-08-26T09:29:57.359Z
Modified
2026-08-28T14:33:01.919683Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
Details

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18794.json",
    "cwe_ids": [
        "CWE-1288"
    ],
    "cna_assigner": "suse"
}
References

Affected packages

Git / gitlab.com/CalcProgrammer1/OpenRGB

Affected ranges

Type
GIT
Repo
https://gitlab.com/CalcProgrammer1/OpenRGB
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d2dd9dcc7369e78f47d01ace19af3750cd89ae66
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0rc3"
        }
    ]
}

Affected versions

release_0.*
release_0.1
release_0.2
release_0.3
release_0.4
release_0.5
release_0.6
release_0.7
release_0.8
release_0.9
release_candidate_1.*
release_candidate_1.0rc1
release_candidate_1.0rc2
release_candidate_1.0rc2wr0
release_candidate_1.0rc3

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-18794-1239d937",
        "target": {
            "function": "ProfileManager::LoadProfileToList",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "95437639852737716356002784434995179729",
            "length": 1092.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-18794-1bdfc767",
        "target": {
            "function": "NetworkClient::ListenThreadFunction",
            "file": "NetworkClient.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "280617671278284019699804019264086409569",
            "length": 2286.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-18794-1d410d88",
        "target": {
            "file": "StringUtils.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322349998864898802794622144854412220568",
                "208698755085950346046112989215359970760",
                "119806124576313253900990977264906326499",
                "284768564687001632512782562956579511671",
                "253724389614060727870871211502056874577",
                "64816052312727547786264032054030361871",
                "19385456728506249526885729010249828762"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-18794-80b989c1",
        "target": {
            "file": "NetworkServer.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275375697301144669591548466861494267373",
                "93096688385561160866853160425515300003",
                "104222903630217327410044352801766909658",
                "139299014324504129761409869262926751735"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-18794-9df5779e",
        "target": {
            "file": "NetworkClient.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161169517863380733557194438788091683508",
                "322316876743499429116701272327275982168",
                "215785893999238604226270163766880771181",
                "230458920664536821973106771008226830015"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-18794-b11e8c3b",
        "target": {
            "function": "ProfileManager::SaveProfile",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "286853739122543647694695458753869014658",
            "length": 1074.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-18794-b806c1fa",
        "target": {
            "function": "ProfileManager::DeleteProfile",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "249749204173706615843152028605700968386",
            "length": 240.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-18794-bf71aaac",
        "target": {
            "file": "StringUtils.h"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "315673586532126711077906701193197624619",
                "120832829731941778623600501317577548993",
                "299656908887905861193477008307806974029"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-18794-dd9f6c7c",
        "target": {
            "function": "NetworkServer::ListenThreadFunction",
            "file": "NetworkServer.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "282757793619303172934404325901327203506",
            "length": 7971.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-18794-dfed457a",
        "target": {
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "323107566027453662779346590227282392295",
                "117406684580505668136167856757136736203",
                "25083145235401289199960849757136280250",
                "232298029481204207568784993017342293038",
                "148832930559292644578287616493885021089",
                "196394819639494740468563460032065282712",
                "303815322209423144492940919573295984472",
                "278476806288386688576281349613644007824",
                "60582079477449156117553867818028096804",
                "190947480793103281972024509200300418345",
                "57108089609289319770918800717505926750",
                "263603095521596482359072863712747898616"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18794.json"
vanir_signatures_modified 
"2026-08-28T14:33:01Z"