CVE-2026-59682: OpenRGB Arbitrary File Overwrite via SAVE_PROFILE

Overview

A critical vulnerability, CVE-2026-59682, has been disclosed in OpenRGB, the popular open-source RGB lighting control application, affecting versions through 1.0rc3. Classified under CWE-73 (External Control of File Name or Path), the flaw arises from how OpenRGB's network protocol handles the SAVE_PROFILE message, allowing an attacker to overwrite — and, via the related DELETE_PROFILE function, delete — arbitrary files on the host filesystem.

The vulnerability was identified and documented by the SUSE Security Team, published August 26, 2026, and carries a CVSS score of 9.1, reflecting a network attack vector requiring no privileges or user interaction.

Technical Details

How It Works

OpenRGB exposes a network protocol used by clients to manage LED lighting profiles. The SAVE_PROFILE message accepts a file path from the client without adequately restricting it to OpenRGB's intended profile storage directory. An attacker who can reach this network interface can craft a SAVE_PROFILE request pointing at an arbitrary path on the filesystem, causing OpenRGB to write (overwrite) attacker-controlled content wherever it has permission to write.

The scope of impact differs by version:

• In OpenRGB versions ≤ 0.9, only local attackers can exploit the issue, and only via symlink attacks
• In versions greater than 0.9, the vulnerability is remotely exploitable directly over the network protocol, with no local access required

This flaw was disclosed alongside two related issues in the same OpenRGB security review:

• CVE-2026-59683 — combines the arbitrary path-write primitive from CVE-2026-59682 with attacker-controlled string content in LED profile data, enabling full remote system compromise (if the daemon runs as root) or full account takeover (if running in user context) — but only in versions greater than 0.9
• CVE-2026-18794 — a cumulative local/remote Denial-of-Service attack surface tied to memory consumption, with possible further privilege-escalation potential via memory corruption

SUSE researchers noted it is likely the macOS and Windows ports of OpenRGB are similarly affected, though those platforms were not independently investigated.

Impact Assessment

Who Is At Risk

• Anyone running OpenRGB through version 1.0rc3 with the network protocol enabled and reachable
• Systems running the OpenRGB server/daemon with elevated privileges (a common configuration for hardware access), where a successful overwrite could target sensitive system files
• Multi-user or shared systems where OpenRGB's network interface is exposed beyond localhost

Potential Attack Chains

1. Network Access — Attacker reaches OpenRGB's client protocol port
2. Path Traversal via SAVE_PROFILE — Attacker crafts a SAVE_PROFILE message targeting a file outside the intended profile directory
3. File Overwrite — Sensitive configuration files, startup scripts, or (combined with CVE-2026-59683) executable content are overwritten
4. Escalation — If OpenRGB runs with elevated privileges, overwritten content can be leveraged for local privilege escalation or full remote code execution

Mitigation

Immediate Actions

• Review the OpenRGB release_candidate_1.0rc3 branch security patch commit and update to a fixed build as soon as one is available for your platform
• Restrict network access to OpenRGB's client protocol — bind it to localhost only unless remote lighting control is explicitly required
• Avoid running the OpenRGB server/daemon with root or administrator privileges where possible
• Firewall the OpenRGB network port from untrusted network segments

Detection Opportunities

• Unexpected file modifications outside OpenRGB's profile storage directory
• Unusual OpenRGB network protocol traffic from unfamiliar clients
• File integrity monitoring alerts on system configuration paths correlating with OpenRGB process activity

Defence-in-Depth

• Run OpenRGB under a dedicated, least-privilege service account rather than root
• Apply filesystem permissions that prevent the OpenRGB process from writing outside its designated data directory
• Segment IoT/peripheral-control software like OpenRGB onto isolated network zones away from critical infrastructure

Background

OpenRGB is a widely used cross-platform, vendor-agnostic RGB lighting control project popular among PC hardware enthusiasts. Its network protocol — designed to let external tools and automation scripts control lighting — becomes a liability here: because the protocol trusts client-supplied file paths without validation, what's normally a convenience feature for lighting profiles turns into a remote file-write primitive. Given the combination with CVE-2026-59683's potential for full remote compromise, users running OpenRGB with its network interface exposed should treat patching as urgent.

References

• SUSE Security Team Blog — OpenRGB: Remote System Compromise via Custom Network Protocol
• OpenRGB GitLab — Security Patch Commit (release_candidate_1.0rc3)
• Threat Radar — CVE-2026-59682
• Threat Radar — CVE-2026-59683