How severe is CVE-2026-18794?

CVE-2026-18794 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.

Is CVE-2026-18794 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-18794?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-18794 published?

CVE-2026-18794 was published on 2026-08-26 and last updated on 2026-09-01.

CVE-2026-18794

CVE-2026-18794 is a high-severity vulnerability with a CVSS 3.x base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1288.

Key facts

Severity: High (CVSS 3.x base score 8.2)
CVSS v4: 8.8
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1288
Published: 2026-08-26
Last modified: 2026-09-01

Description

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

Frequently asked questions

What is CVE-2026-18794?: The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.
How severe is CVE-2026-18794?: CVE-2026-18794 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.
Is CVE-2026-18794 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-18794?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-18794 published?: CVE-2026-18794 was published on 2026-08-26 and last updated on 2026-09-01.

References

Other CWE-1288 vulnerabilities

CVE-2026-31709 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before…
CVE-2026-56744 — High (CVSS 8.7): `@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and…
CVE-2026-42982 — High (CVSS 7.8): Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate…
CVE-2022-50976 — High (CVSS 7.7): A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
CVE-2026-69793 — High (CVSS 7.5): Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security…
CVE-2024-39515 — High (CVSS 7.5): An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper…

Browse all CWE-1288 vulnerabilities →