Is CVE-2026-59682 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59682 being exploited in the wild.

How severe is CVE-2026-59682?

Critical severity, with a CVSS score of 9.1, published 26 August 2026.

Which products and versions are affected?

OpenRGB OpenRGB through 1.0rc3.

Is there a fix for CVE-2026-59682?

A patch was published on 2026-08-12: Security fixes applied in commit d2dd9dcc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59682 attacked?

It is attacked over the network.

Am I affected by CVE-2026-59682?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59682: OpenRGB arbitrary file overwrite via SAVE_PROFILE message

CVE-2026-59682 · Severity: critical · CVSS 9.1 · Published 2026-08-26

OpenRGB is lighting control software for RGB peripherals that communicates via a network protocol. A flaw in how it processes profile-save commands allows attackers to overwrite or delete arbitrary files on the system, potentially compromising the entire device or enabling malware installation.

Quick answers

Is CVE-2026-59682 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59682 being exploited in the wild.
How severe is CVE-2026-59682?: Critical severity, with a CVSS score of 9.1, published 26 August 2026.
Which products and versions are affected?: OpenRGB OpenRGB through 1.0rc3.
Is there a fix for CVE-2026-59682?: A patch was published on 2026-08-12: Security fixes applied in commit d2dd9dcc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59682 attacked?: It is attacked over the network.
Am I affected by CVE-2026-59682?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SAVE_PROFILE message in OpenRGB's network protocol fails to properly validate the profile name parameter before using it in file system operations. An attacker can inject path traversal sequences (e.g., "../") or special characters into the profile name to cause the application to write files to unintended locations on disk. The vulnerability affects the ProfileManager::SaveProfile() and ProfileManager::DeleteProfile() functions. No authentication is required as the network interface listens on all interfaces (0.0.0.0) by default. The patch (commit d2dd9dcc) introduces a StringUtils::make_filename() function to sanitize profile names by removing path traversal characters and special characters before file operations.

Affected products

OpenRGB OpenRGB through 1.0rc3

Timeline

2026-08-26: disclosed
2026-08-12: patched: Security fixes applied in commit d2dd9dcc

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.