Description
Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceGetDescriptionString components
Published: 2026-08-17
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Buffer overflow in SteelSeries GG on macOS version 107.0.0 allows an attacker to run arbitrary code through the libSSEdevice.dylib and CxAudioHidDevice::DeviceGetDescriptionString components. The flaw can compromise confidentiality, integrity and availability of the affected system.

Affected Systems

The vulnerability affects SteelSeries GG (macOS) version 107.0.0. Users should confirm the installed build and determine if they are running the affected client.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity and the EPSS score is < 1%, suggesting a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA's KEV catalog. While it enables arbitrary code execution, the exact attack vector is not detailed; it likely requires interaction with the device library, suggesting a local or device‑based remote exploitation scenario. The risk is high if an attacker can trigger the library call.

Generated by OpenCVE AI on August 18, 2026 at 22:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest SteelSeries GG (macOS) update that contains the fixed libSSEdevice.dylib, if available.
  • If no update exists, disconnect all SteelSeries devices from the system until a patch is released to mitigate potential exploitation.
  • Regularly review the SteelSeries security advisory page and the GitHub repository linked in the references for further updates.

Generated by OpenCVE AI on August 18, 2026 at 22:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Buffer Overflow in SteelSeries GG macOS
Weaknesses CWE-119

Tue, 18 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 17 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Steelseries
Steelseries gg
Vendors & Products Steelseries
Steelseries gg

Mon, 17 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Buffer Overflow in SteelSeries GG macOS
Weaknesses CWE-119

Mon, 17 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, CxAudioHidDevice::DeviceGetDescriptionString components
References

Subscriptions

Steelseries Gg
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-18T16:00:50.465Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-39254

cve-icon Vulnrichment

Updated: 2026-08-18T16:00:43.615Z

cve-icon NVD

Status : Received

Published: 2026-08-17T21:16:44.710

Modified: 2026-08-18T16:17:04.303

Link: CVE-2026-39254

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T22:45:03Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')