CVE-2026-59682: CWE-73: External Control of File Name or Path in CalcProgrammer1 OpenRGB

CVE-2026-59682 is a vulnerability in OpenRGB, a software project by CalcProgrammer1, affecting versions up to 1.0rc3. It allows an attacker to overwrite arbitrary files on the system by exploiting the SAVE_PROFILE message handling, which improperly allows external control over file names or paths. This vulnerability is categorized under CWE-73, indicating that the software does not properly restrict file path input, leading to potential arbitrary file overwrite. The CVSS v4.0 base score is 8.8, reflecting high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and availability. No official patch or remediation has been provided by the vendor as of the published date.

An attacker can overwrite arbitrary files on the affected system remotely without authentication or user interaction. This can lead to denial of service or potentially further compromise depending on which files are overwritten. The vulnerability has a high CVSS score of 8.8, indicating significant risk to confidentiality and availability.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates. Until a fix is released, consider restricting network access to the OpenRGB service or running it with minimal privileges to limit potential impact.