Executive brief
SignalRGB is a Windows application used to control lighting and monitor hardware performance. A vulnerability in its system driver allows a local user to crash the entire computer, leading to a blue screen or system restart. This can be used to disrupt operations or cause a denial of service on affected machines.
Technical details
The SignalRGB kernel driver, SignalIo.sys, fails to validate input buffer pointers in seven of its sixteen IOCTL handlers. When using METHOD_BUFFERED, the SystemBuffer pointer is NULL if both InputBufferLength and OutputBufferLength are zero. Because the driver dereferences this pointer without a non-NULL check, a local attacker can send a specially crafted IOCTL request with an empty input buffer to trigger a NULL pointer dereference. This results in an immediate kernel crash (Denial of Service). The issue is resolved in version 1.3.7.0, which implements proper buffer size validation.
Affected products
- SignalRGB SignalRGB kernel driver (SignalIo.sys) prior to 1.3.7.0
Timeline
- 2026-03-25: other: Vendor notified
- 2026-06-17: disclosed: Public disclosure via CERT/CC and NVD
- 2026-06-17: patched: Remediated in version 1.3.7.0