CVE-2026-8049

Deferred Deferred - Pending Action

SignalRGB Local Privilege Escalation via IOCTL

Publication date: 2026-06-17

Last updated on: 2026-06-22

Assigner: CERT/CC

Description

In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_OPEN. This results in overly permissive default access control, allowing any authenticated local user to obtain a handle to the device and issue privileged IOCTLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-22

Generated

2026-07-08

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-8049

EUVD

EUVD-2026-37803

Affected Vendors & Products

Vendor	Product	Version / Range
signalrgb	signalrgb	to 1.3.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Impact Analysis

This vulnerability allows any authenticated local user to gain unauthorized access to the SignalIo device and perform privileged operations via IOCTL commands.

Such unauthorized access can lead to privilege escalation or unauthorized control over device functions, potentially compromising system security or stability.

Executive Summary

In SignalRGB versions prior to 1.3.7.0, the device object named \\.\SignalIo is created without a proper security descriptor and without the FILE_DEVICE_SECURE_OPEN flag. This means that the device has overly permissive default access controls.

As a result, any authenticated local user can obtain a handle to this device and issue privileged IOCTL (Input Output Control) commands, which they should not normally be allowed to execute.

Hi! I’m here to help you understand CVE-2026-8049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70