High · 8.2 CVE-2026-18794 EUVD-2026-66362GHSA-2hph-9m2g-p27v

OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

Published Aug 26, 2026 · Updated Aug 26, 2026 · Assigned by suse

Vendor: CalcProgrammer1 Product: OpenRGB Package: openrgb Package: openrgb Ecosystem: Debian Ecosystem: Ubuntu

Description

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

Affected products

Vendor	Product	Affected	Fixed
CalcProgrammer1	OpenRGB	≤ 1.0rc3	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	openrgb	1.0+ds-0.1	—

Ubuntu