CVE-2026-18794

HighCVSS 8.2/10Last modified Sep 1, 2026

Description

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-1288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CalcProgrammer1OpenRGB<= 1.0rc3

References

Timeline

Published
Aug 26, 2026
Last modified
Sep 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-187956.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side whicCVE-2026-187966.8Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/oCVE-2026-187987.5Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summaryCVE-2026-187994.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding tCVE-2026-18805.4An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due CVE-2026-188004.4When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irCVE-2026-188019.3OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attackCVE-2026-188067.1External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows ReCVE-2026-188074.3The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a noncCVE-2026-188089.8Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet ObjectsCVE-2026-188096.5Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.CVE-2026-18814.3The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the
CVE-2026-18794: High severity, CVSS 8.2 | Vulnix