Multiple vulnerabilities have been found in OpenRGB, allowing root remote command execution.

Announced

2026-08-27

Revised

2026-08-27

Access

local and remote

Bugs

#981449

Advisory

https://security.gentoo.org/glsa/202608-30

Affected packages

Package	Arch	Vulnerable	Unaffected
app-misc/openrgb	*	< 1.0_rc3_p1	>= 1.0_rc3_p1

Background

OpenRGB is a cross-platform software suite for controlling RGB LED lighting devices.

Description

Multiple vulnerabilities have been discovered in OpenRGB. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time. Users are recommended to avoid exposing OpenRGB to the network even with these fixes.

Resolution

All OpenRGB users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-misc/openrgb-1.0_rc3_p1"

References

• CVE-2026-18794
• CVE-2026-59682
• CVE-2026-59683