CVE-2026-59683

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59683
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59683.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59683
Published
2026-08-26T09:24:42.722Z
Modified
2026-08-28T14:33:06.114559Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
Details

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59683.json",
    "cwe_ids": [
        "CWE-73"
    ],
    "cna_assigner": "suse"
}
References

Affected packages

Git / gitlab.com/CalcProgrammer1/OpenRGB

Affected ranges

Type
GIT
Repo
https://gitlab.com/CalcProgrammer1/OpenRGB
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d2dd9dcc7369e78f47d01ace19af3750cd89ae66
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0rc3"
        }
    ]
}

Affected versions

release_0.*
release_0.1
release_0.2
release_0.3
release_0.4
release_0.5
release_0.6
release_0.7
release_0.8
release_0.9
release_candidate_1.*
release_candidate_1.0rc1
release_candidate_1.0rc2
release_candidate_1.0rc2wr0
release_candidate_1.0rc3

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-59683-1239d937",
        "target": {
            "function": "ProfileManager::LoadProfileToList",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "95437639852737716356002784434995179729",
            "length": 1092.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-59683-1bdfc767",
        "target": {
            "function": "NetworkClient::ListenThreadFunction",
            "file": "NetworkClient.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "280617671278284019699804019264086409569",
            "length": 2286.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-59683-1d410d88",
        "target": {
            "file": "StringUtils.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322349998864898802794622144854412220568",
                "208698755085950346046112989215359970760",
                "119806124576313253900990977264906326499",
                "284768564687001632512782562956579511671",
                "253724389614060727870871211502056874577",
                "64816052312727547786264032054030361871",
                "19385456728506249526885729010249828762"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-59683-80b989c1",
        "target": {
            "file": "NetworkServer.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275375697301144669591548466861494267373",
                "93096688385561160866853160425515300003",
                "104222903630217327410044352801766909658",
                "139299014324504129761409869262926751735"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-59683-9df5779e",
        "target": {
            "file": "NetworkClient.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161169517863380733557194438788091683508",
                "322316876743499429116701272327275982168",
                "215785893999238604226270163766880771181",
                "230458920664536821973106771008226830015"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-59683-b11e8c3b",
        "target": {
            "function": "ProfileManager::SaveProfile",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "286853739122543647694695458753869014658",
            "length": 1074.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-59683-b806c1fa",
        "target": {
            "function": "ProfileManager::DeleteProfile",
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "249749204173706615843152028605700968386",
            "length": 240.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-59683-bf71aaac",
        "target": {
            "file": "StringUtils.h"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "315673586532126711077906701193197624619",
                "120832829731941778623600501317577548993",
                "299656908887905861193477008307806974029"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-59683-dd9f6c7c",
        "target": {
            "function": "NetworkServer::ListenThreadFunction",
            "file": "NetworkServer.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "282757793619303172934404325901327203506",
            "length": 7971.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-59683-dfed457a",
        "target": {
            "file": "ProfileManager.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "323107566027453662779346590227282392295",
                "117406684580505668136167856757136736203",
                "25083145235401289199960849757136280250",
                "232298029481204207568784993017342293038",
                "148832930559292644578287616493885021089",
                "196394819639494740468563460032065282712",
                "303815322209423144492940919573295984472",
                "278476806288386688576281349613644007824",
                "60582079477449156117553867818028096804",
                "190947480793103281972024509200300418345",
                "57108089609289319770918800717505926750",
                "263603095521596482359072863712747898616"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/CalcProgrammer1/OpenRGB@d2dd9dcc7369e78f47d01ace19af3750cd89ae66",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59683.json"
vanir_signatures_modified 
"2026-08-28T14:33:06Z"