Bug 2527464

Summary:	CVE-2026-59683 openrgb: OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Samuele Negrini <snegrini>
Component:	openrgb	Assignee:	Orphan Owner <extras-orphan>
Status:	NEW ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	epel10	CC:	ego.cordatus, extras-orphan
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["1ce8454b-e1db-4a0c-853a-5148c456733e"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2524310

Description Samuele Negrini 2026-09-02 14:06:25 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).