Is CVE-2026-18794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18794 being exploited in the wild.

How severe is CVE-2026-18794?

High severity, with a CVSS score of 8.2, published 26 August 2026.

Which products and versions are affected?

Adam Honse OpenRGB before 0.9 rc3.

Is there a fix for CVE-2026-18794?

A patch was published on 2026-08-12: Fix committed in release_candidate_1.0rc3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18794 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18794?

Check whether you run Adam Honse OpenRGB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18794: OpenRGB network protocol memory exhaustion and out-of-bounds access

CVE-2026-18794 · Severity: high · CVSS 8.2 · Published 2026-08-26

OpenRGB is a cross-platform RGB lighting control application that provides a network protocol for remote device communication. A flaw in the network protocol allows attackers to trigger memory exhaustion and out-of-bounds memory access by sending specially crafted packets with inconsistent data, leading to denial of service or potential system compromise.

Technologies: Adam Honse OpenRGB. Vendors: Adam Honse.

Quick answers

Is CVE-2026-18794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18794 being exploited in the wild.
How severe is CVE-2026-18794?: High severity, with a CVSS score of 8.2, published 26 August 2026.
Which products and versions are affected?: Adam Honse OpenRGB before 0.9 rc3.
Is there a fix for CVE-2026-18794?: A patch was published on 2026-08-12: Fix committed in release_candidate_1.0rc3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18794 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18794?: Check whether you run Adam Honse OpenRGB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in OpenRGB's network protocol implementation (NetworkClient.cpp and NetworkServer.cpp) where insufficient validation of packet size headers allows attackers to cause memory exhaustion and out-of-bounds access. The flaw occurs when receiving network packets with inconsistent data—specifically when the declared packet size (pkt_size) in the header is not properly validated before memory allocation. An unauthenticated attacker with network access to the OpenRGB SDK port (default 6742) can send malicious packets to trigger denial of service or memory corruption. The fix involves adding validation to reject packets exceeding OPENRGB_SDK_MAX_PACKET_SIZE (8MB) before processing.

Affected products

Adam Honse OpenRGB before 0.9 rc3

Timeline

2026-08-26: disclosed
2026-08-12: patched: Fix committed in release_candidate_1.0rc3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.