{"id":"CVE-2026-59682","summary":"Arbitrary file overwrite and deletion local and remote in OpenRGB","details":"Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.","modified":"2026-10-08T07:14:19.973460241Z","published":"2026-08-26T09:13:22.465Z","related":["openSUSE-SU-2026:11602-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59682.json","cna_assigner":"suse","cwe_ids":["CWE-73"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59682.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59682"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=1274000"},{"type":"FIX","url":"https://gitlab.com/CalcProgrammer1/OpenRGB/-/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66"},{"type":"PACKAGE","url":"https://gitlab.com/CalcProgrammer1/OpenRGB"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/calcprogrammer1/openrgb","events":[{"introduced":"0"},{"fixed":"d2dd9dcc7369e78f47d01ace19af3750cd89ae66"}],"database_specific":{"source":"REFERENCES"}}],"versions":["release_candidate_1.0rc3","release_0.9","release_candidate_1.0rc2","release_candidate_1.0rc2wr0","release_candidate_1.0rc1","release_0.8","release_0.7","release_0.6","release_0.5","release_0.4","release_0.3","release_0.2","release_0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59682.json","vanir_signatures":[{"digest":{"length":7971,"function_hash":"282757793619303172934404325901327203506"},"id":"CVE-2026-59682-10350a2b","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"function":"NetworkServer::ListenThreadFunction","file":"NetworkServer.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"StringUtils.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["322349998864898802794622144854412220568","208698755085950346046112989215359970760","119806124576313253900990977264906326499","284768564687001632512782562956579511671","253724389614060727870871211502056874577","64816052312727547786264032054030361871","19385456728506249526885729010249828762"]},"id":"CVE-2026-59682-10b8951e","signature_type":"Line"},{"signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"ProfileManager.cpp"},"deprecated":false,"digest":{"line_hashes":["323107566027453662779346590227282392295","117406684580505668136167856757136736203","25083145235401289199960849757136280250","232298029481204207568784993017342293038","148832930559292644578287616493885021089","196394819639494740468563460032065282712","303815322209423144492940919573295984472","278476806288386688576281349613644007824","60582079477449156117553867818028096804","190947480793103281972024509200300418345","57108089609289319770918800717505926750","263603095521596482359072863712747898616"],"threshold":0.9},"id":"CVE-2026-59682-52de91e0","signature_type":"Line"},{"signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"StringUtils.h"},"deprecated":false,"digest":{"line_hashes":["315673586532126711077906701193197624619","120832829731941778623600501317577548993","299656908887905861193477008307806974029"],"threshold":0.9},"id":"CVE-2026-59682-61f9f340","signature_type":"Line"},{"deprecated":false,"digest":{"length":1074,"function_hash":"286853739122543647694695458753869014658"},"id":"CVE-2026-59682-79e4499a","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"function":"ProfileManager::SaveProfile","file":"ProfileManager.cpp"}},{"source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"ProfileManager.cpp","function":"ProfileManager::DeleteProfile"},"deprecated":false,"digest":{"length":240,"function_hash":"249749204173706615843152028605700968386"},"id":"CVE-2026-59682-821b107f","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-59682-84a3dccd","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"NetworkClient.cpp"},"deprecated":false,"digest":{"line_hashes":["161169517863380733557194438788091683508","322316876743499429116701272327275982168","215785893999238604226270163766880771181","230458920664536821973106771008226830015"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"ProfileManager.cpp","function":"ProfileManager::LoadProfileToList"},"deprecated":false,"digest":{"function_hash":"95437639852737716356002784434995179729","length":1092},"id":"CVE-2026-59682-afde58c1"},{"id":"CVE-2026-59682-b480deb6","signature_type":"Line","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"NetworkServer.cpp"},"deprecated":false,"digest":{"line_hashes":["275375697301144669591548466861494267373","93096688385561160866853160425515300003","104222903630217327410044352801766909658","139299014324504129761409869262926751735"],"threshold":0.9}},{"id":"CVE-2026-59682-fcb245ae","signature_type":"Function","signature_version":"v1","source":"https://gitlab.com/calcprogrammer1/openrgb@d2dd9dcc7369e78f47d01ace19af3750cd89ae66","target":{"file":"NetworkClient.cpp","function":"NetworkClient::ListenThreadFunction"},"deprecated":false,"digest":{"length":2286,"function_hash":"280617671278284019699804019264086409569"}}],"vanir_signatures_modified":"2026-10-08T07:14:19Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}