CVE-2026-18794: OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
Published Aug 25, 2026
·Updated
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.
Affected Software
1 affected component
OpenRGB OpenRGB
Event History
Aug 26, 2026
CVE Published
via MITRE·09:29 AM
Data Sourced
via MITRE·09:29 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker who can reach the OpenRGB network protocol can exploit it remotely. No privileges or user interaction are required.
2
What impact can exploitation have?
Malformed inconsistent data can cause memory exhaustion, out-of-bounds memory reads, and out-of-bounds memory writes. This can result in denial of service and may affect integrity and availability.
3
What should be prioritized for mitigation?
Restrict network access to the OpenRGB network protocol to trusted hosts until the referenced fix can be applied. The available information does not identify affected or fixed OpenRGB versions.