OpenRGB CVE-2026-18794

The OpenRGB server must be running and TCP port 6742 must be reachable by the attacker - either over the network (if host or network firewall rules allow it) or via localhost (always accessible to any local user regardless of firewall). The 'Restart=always' systemd directive in the openSUSE Tumbleweed packaging means each crash automatically restores the attack surface, enabling DoS cycling. No authentication, session state, or protocol handshake is required prior to sending the malformed packet. Exploitation is limited by: (1) firewall rules - default-enabled firewalls on most Linux distributions block external access to port 6742; (2) the systemd service must be enabled and running; (3) for remote exploitation specifically, the host must be network-accessible on that port.

CVE-2026-18794 presents a meaningful real-world risk for any deployment where TCP port 6742 is network-reachable. No CVSS vector was supplied; independently assessed, the attack is network-vectored, low-complexity, requires no privileges or user interaction, and produces High availability impact - approximately CVSS 7.5. The most significant risk amplifier is the root-privilege systemd service pattern in openSUSE Tumbleweed combined with 'Restart=always', meaning repeated DoS cycling is possible and each crash restores the attack surface automatically. CVE-2026-18794 runs in the same process and service as CVE-2026-59683 (remote root RCE), meaning a DoS-capable attacker is positioned adjacent to full system compromise. No EPSS score was provided; the published Python reproducer script makes exploitation trivially accessible. Risk is bounded by the fact that this is consumer-oriented hobbyist software with a small enterprise footprint, and that default Linux firewall configurations would block external access to port 6742 - local users, however, always have access via localhost regardless of firewall state.

An attacker with access to TCP port 6742 - remotely if firewall rules permit, or locally via localhost - connects without any authentication and sends a crafted NetPacketHeader specifying a pkt_size value that drives an enormous or pathological memory allocation in the server's parsing loop. The OpenRGB daemon, running as root under 'Restart=always', crashes and is immediately restarted, enabling repeated cycling. The published Python reproducer script makes this reproducible with minimal expertise.