CVE-2026-59683

Name	CVE-2026-59683
Description	The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145783

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openrgb (PTS)	sid	0.9+git20251009+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openrgb	source	(unstable)	(unfixed)			1145783

Notes

https://www.openwall.com/lists/oss-security/2026/08/25/4
Fixed by: https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66 (release_candidate_1.0rc3.1)