OpenRGB Release Candidate 1.0rc3.1

- CVE-2026-59682: OpenRGB: arbitrary file overwrite and deletion local and remote
- CVE-2026-59683: OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
- CVE-2026-18794: OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

.gitlab-ci.yml

@@ -14,9 +14,9 @@
 #   run only if manually started to save CI minutes if      #
 #   GitLab hosted runners                                   #
 # * For commits to the CalcProgrammer1/OpenRGB repository,  #
-#   automatically run all jobs on the default branch,       #
-#   otherwise run them if the source is part of a merge     #
-#   request                                                 #
+#   automatically run all jobs on the default branch or     #
+#   tag builds, otherwise run them if the source is part    #
+#   of a merge request                                      #
 #-----------------------------------------------------------#
 .downstream_rules:
   rules:
@@ -26,7 +26,7 @@
 
 .upstream_rules:
   rules:
-  - if: '$CI_PROJECT_PATH == "CalcProgrammer1/OpenRGB" && ($CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_PIPELINE_SOURCE == "merge_request_event")'
+  - if: '$CI_PROJECT_PATH == "CalcProgrammer1/OpenRGB" && ($CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_TAG || $CI_PIPELINE_SOURCE == "merge_request_event")'
     when: on_success
   - !reference [.downstream_rules, rules]
 

NetworkClient.cpp

@@ -515,7 +515,11 @@ void NetworkClient::ListenThreadFunction()
         /*---------------------------------------------------------*\
         | Header received, now receive the data                     |
         \*---------------------------------------------------------*/
-        if(header.pkt_size > 0)
+        if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE)
+        {
+            goto listen_done;
+        }
+        else if(header.pkt_size > 0)
         {
             bytes_read = 0;
 

NetworkProtocol.h

@@ -27,7 +27,12 @@
 /*-----------------------------------------------------*\
 | Default Interface to bind to.                         |
 \*-----------------------------------------------------*/
-#define OPENRGB_SDK_HOST "0.0.0.0"
+#define OPENRGB_SDK_HOST "127.0.0.1"
+
+/*-----------------------------------------------------*\
+| Default max packet size is 8MB                        |
+\*-----------------------------------------------------*/
+#define OPENRGB_SDK_MAX_PACKET_SIZE (1024 * 1024 * 8)
 
 /*-----------------------------------------------------*\
 | Default OpenRGB SDK port is 6742                      |

NetworkServer.cpp

@@ -627,7 +627,12 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info)
         | Header received, now receive the data                     |
         \*---------------------------------------------------------*/
         bytes_read = 0;
-        if(header.pkt_size > 0)
+        if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE)
+        {
+            LOG_ERROR("[NetworkServer] received too large packet, closing listener");
+            goto listen_done;
+        }
+        else if(header.pkt_size > 0)
         {
             data = new char[header.pkt_size];
 

OpenRGB.pro

@@ -26,7 +26,7 @@ greaterThan(QT_MAJOR_VERSION, 4): QT += widgets
 #-----------------------------------------------------------------------------------------------#
 MAJOR       = 0
 MINOR       = 9
-SUFFIX      = 1.0rc3
+SUFFIX      = 1.0rc3.1
 
 SHORTHASH   = $$system("git rev-parse --short=7 HEAD")
 LASTTAG     = "release_"$$MAJOR"."$$MINOR

ProfileManager.cpp

@@ -66,7 +66,7 @@ bool ProfileManager::SaveProfile(std::string profile_name, bool sizes)
         /*---------------------------------------------------------*\
         | Open an output file in binary mode                        |
         \*---------------------------------------------------------*/
-        filesystem::path profile_path = configuration_directory / filesystem::u8path(filename);
+        filesystem::path profile_path = configuration_directory / filesystem::u8path(StringUtils::make_filename(filename));
         std::ofstream controller_file(profile_path, std::ios::out | std::ios::binary | std::ios::trunc);
 
         /*---------------------------------------------------------*\
@@ -149,7 +149,7 @@ std::vector<RGBController*> ProfileManager::LoadProfileToList
     unsigned int                controller_size;
     unsigned int                controller_offset = 0;
 
-    filesystem::path filename = configuration_directory / filesystem::u8path(profile_name);
+    filesystem::path filename = configuration_directory / filesystem::u8path(StringUtils::make_filename(profile_name));
 
     /*---------------------------------------------------------*\
     | Determine file extension                                  |
@@ -437,7 +437,7 @@ void ProfileManager::DeleteProfile(std::string profile_name)
 {
     profile_name = StringUtils::remove_null_terminating_chars(profile_name);
 
-    filesystem::path filename = configuration_directory / profile_name;
+    filesystem::path filename = configuration_directory / StringUtils::make_filename(profile_name);
     filename.concat(".orp");
 
     filesystem::remove(filename);

StringUtils.cpp

@@ -22,6 +22,7 @@
 #include <cctype>
 #include <codecvt>
 #include <locale>
+#include <regex>
 #include <string>
 #include "StringUtils.h"
 
@@ -113,6 +114,34 @@ std::string StringUtils::u32int_to_hexString(unsigned int value)
     return std::string(hex_str);
 }
 
+std::string StringUtils::make_filename(std::string input)
+{
+    /*-----------------------------------------------------*\
+    | Replace : characters with - characters                |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex(":"), "-");
+
+    /*-----------------------------------------------------*\
+    | Remove all other characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove leading . characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("^\\.+"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove control characters                             |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), "");
+
+    /*-----------------------------------------------------*\
+    | Return complete string                                |
+    \*-----------------------------------------------------*/
+    return(input);
+}
+
 std::string StringUtils::normalize_hex_id(const std::string& id)
 {
     std::string out;

StringUtils.h

@@ -20,5 +20,6 @@ public:
     static std::string u16string_to_string(const std::u16string wstring);
     static const std::string remove_null_terminating_chars(std::string input);
     static std::string u32int_to_hexString(unsigned int value);
+    static std::string make_filename(std::string input);
     static std::string normalize_hex_id(const std::string& id);
 };

qt/openrgb.service

@@ -3,10 +3,20 @@ Description=OpenRGB SDK Server
 After=network.target lm_sensors.service
 
 [Service]
-ExecStart=/usr/bin/openrgb --server --config /etc/openrgb
+ExecStart=/usr/bin/openrgb --server --noautoconnect --config /etc/openrgb
 Restart=always
 RuntimeDirectory=openrgb
 WorkingDirectory=/run/openrgb
 
+ProtectSystem=strict
+ProtectHome=true
+
+PrivateDevices=false
+ProtectKernelTunables=false
+ProtectControlGroups=false
+
+ReadWritePaths=/etc/openrgb
+ReadWritePaths=/run/openrgb
+
 [Install]
 WantedBy=multi-user.target

qt/org.openrgb.OpenRGB.metainfo.xml

@@ -48,6 +48,8 @@
   </description>
 
   <releases>
+    <release version="1.0rc3.1" date="2026-08-23"></release>
+    <release version="1.0rc3" date="2026-06-28"></release>
     <release version="1.0rc2" date="2025-09-14"></release>
     <release version="1.0rc1" date="2025-02-22"></release>
     <release version="0.9" date="2023-06-09"></release>

scripts/prepare-artifacts.py

@@ -12,12 +12,12 @@ import os
 #############################################
 # OpenRGB version                           #
 #############################################
-version = "1.0rc3"
+version = "1.0rc3.1"
 
 #############################################
 # Git version (tag, branch, or commit)      #
 #############################################
-git_id = "release_candidate_1.0rc3"
+git_id = "release_candidate_1.0rc3.1"
 
 command = "git rev-list -n 1 " + git_id
 print(command)