Address security issues in release_candidate_1.0rc3

- CVE-2026-59682: OpenRGB: arbitrary file overwrite and deletion local and remote
- CVE-2026-59683: OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings
- CVE-2026-18794: OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite

NetworkClient.cpp

@@ -515,7 +515,11 @@ void NetworkClient::ListenThreadFunction()
         /*---------------------------------------------------------*\
         | Header received, now receive the data                     |
         \*---------------------------------------------------------*/
-        if(header.pkt_size > 0)
+        if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE)
+        {
+            goto listen_done;
+        }
+        else if(header.pkt_size > 0)
         {
             bytes_read = 0;
 

NetworkProtocol.h

@@ -27,7 +27,12 @@
 /*-----------------------------------------------------*\
 | Default Interface to bind to.                         |
 \*-----------------------------------------------------*/
-#define OPENRGB_SDK_HOST "0.0.0.0"
+#define OPENRGB_SDK_HOST "127.0.0.1"
+
+/*-----------------------------------------------------*\
+| Default max packet size is 8MB                        |
+\*-----------------------------------------------------*/
+#define OPENRGB_SDK_MAX_PACKET_SIZE (1024 * 1024 * 8)
 
 /*-----------------------------------------------------*\
 | Default OpenRGB SDK port is 6742                      |

NetworkServer.cpp

@@ -627,7 +627,12 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info)
         | Header received, now receive the data                     |
         \*---------------------------------------------------------*/
         bytes_read = 0;
-        if(header.pkt_size > 0)
+        if(header.pkt_size > OPENRGB_SDK_MAX_PACKET_SIZE)
+        {
+            LOG_ERROR("[NetworkServer] received too large packet, closing listener");
+            goto listen_done;
+        }
+        else if(header.pkt_size > 0)
         {
             data = new char[header.pkt_size];
 

ProfileManager.cpp

@@ -66,7 +66,7 @@ bool ProfileManager::SaveProfile(std::string profile_name, bool sizes)
         /*---------------------------------------------------------*\
         | Open an output file in binary mode                        |
         \*---------------------------------------------------------*/
-        filesystem::path profile_path = configuration_directory / filesystem::u8path(filename);
+        filesystem::path profile_path = configuration_directory / filesystem::u8path(StringUtils::make_filename(filename));
         std::ofstream controller_file(profile_path, std::ios::out | std::ios::binary | std::ios::trunc);
 
         /*---------------------------------------------------------*\
@@ -149,7 +149,7 @@ std::vector<RGBController*> ProfileManager::LoadProfileToList
     unsigned int                controller_size;
     unsigned int                controller_offset = 0;
 
-    filesystem::path filename = configuration_directory / filesystem::u8path(profile_name);
+    filesystem::path filename = configuration_directory / filesystem::u8path(StringUtils::make_filename(profile_name));
 
     /*---------------------------------------------------------*\
     | Determine file extension                                  |
@@ -437,7 +437,7 @@ void ProfileManager::DeleteProfile(std::string profile_name)
 {
     profile_name = StringUtils::remove_null_terminating_chars(profile_name);
 
-    filesystem::path filename = configuration_directory / profile_name;
+    filesystem::path filename = configuration_directory / StringUtils::make_filename(profile_name);
     filename.concat(".orp");
 
     filesystem::remove(filename);

StringUtils.cpp

@@ -22,6 +22,7 @@
 #include <cctype>
 #include <codecvt>
 #include <locale>
+#include <regex>
 #include <string>
 #include "StringUtils.h"
 
@@ -113,6 +114,34 @@ std::string StringUtils::u32int_to_hexString(unsigned int value)
     return std::string(hex_str);
 }
 
+std::string StringUtils::make_filename(std::string input)
+{
+    /*-----------------------------------------------------*\
+    | Replace : characters with - characters                |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex(":"), "-");
+
+    /*-----------------------------------------------------*\
+    | Remove all other characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove leading . characters                           |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("^\\.+"), "");
+
+    /*-----------------------------------------------------*\
+    | Remove control characters                             |
+    \*-----------------------------------------------------*/
+    input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), "");
+
+    /*-----------------------------------------------------*\
+    | Return complete string                                |
+    \*-----------------------------------------------------*/
+    return(input);
+}
+
 std::string StringUtils::normalize_hex_id(const std::string& id)
 {
     std::string out;

StringUtils.h

@@ -20,5 +20,6 @@ public:
     static std::string u16string_to_string(const std::u16string wstring);
     static const std::string remove_null_terminating_chars(std::string input);
     static std::string u32int_to_hexString(unsigned int value);
+    static std::string make_filename(std::string input);
     static std::string normalize_hex_id(const std::string& id);
 };

qt/openrgb.service

@@ -3,10 +3,20 @@ Description=OpenRGB SDK Server
 After=network.target lm_sensors.service
 
 [Service]
-ExecStart=/usr/bin/openrgb --server --config /etc/openrgb
+ExecStart=/usr/bin/openrgb --server --noautoconnect --config /etc/openrgb
 Restart=always
 RuntimeDirectory=openrgb
 WorkingDirectory=/run/openrgb
 
+ProtectSystem=strict
+ProtectHome=true
+
+PrivateDevices=false
+ProtectKernelTunables=false
+ProtectControlGroups=false
+
+ReadWritePaths=/etc/openrgb
+ReadWritePaths=/run/openrgb
+
 [Install]
 WantedBy=multi-user.target