OpenRGB accepts a SAVE_PROFILE message that enables an attacker to specify a file path. This flaw, identified as CWE‑73, permits arbitrary overwriting or deletion of files on the host system, compromising file integrity and availability. An attacker who can send the malformed save request could replace critical system files or remove essential binaries, potentially leading to privilege escalation or service disruption.

The vulnerability applies to CalcProgrammer1’s OpenRGB product version 1.0rc3 and earlier. Users running any of these releases are exposed.

The CVSS score is 8.8, indicating a high severity vulnerability. EPSS information is not reported, and the issue is not listed in CISA’s KEV catalog. While the description does not explicitly state the attack vector, the ability to trigger the action via the message interface suggests it is exploitable locally by a user running OpenRGB and could be remotely exploitable if the message interface is exposed over a network or another process. Proper validation of the file path parameter is missing, enabling the overwrite or deletion of arbitrary files.