- GIGABYTE Control Center carried critical CVE‑2026‑4415 vulnerability in its pairing feature
- Flaw allowed unauthenticated remote attackers to write arbitrary files, execute code, and escalate privileges
- Patch released in version 25.12.10.01; users urged to update immediately to secure affected systems
GIGABYTE Control Center, a Windows utility which comes preloaded with certain computers, carried a critical-severity vulnerability that allowed malicious actors to access files, run code, and trigger denial-of-service conditions on affected devices.
The bug has now been addressed and users are advised to patch up without delay.
GIGABYTE is a major hardware manufacturer known for, among other things, PC motherboards. It also built and maintains GIGABYTE Control Center, a utility program for PCs powered by its motherboards. Inside, users can manage and configure different hardware components, such as fans, RGB lights, driver and firmware updates, and more.
Article continues below
“Pairing” is to blame
One of its features, called ‘pairing’ was the root cause of this issue. Pairing is a feature that allows Control Center to communicate with other devices over a network.
“When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation,” the National Vulnerability Database explained.
Some sources claim the attack does not require user interaction or prior authentication, which would make it more dangerous than your average, run-of-the-mill bug.
It is probably the reason why the bug, now tracked as CVE-2026-4415, was given a severity score of 9.2/10 (critical). It was first disclosed by Taiwan’s Computer Emergency Response Team (TWCERT/CC), who credited security researcher David Sprüngli for the discovery.
Versions 25.07.21.01 and earlier are apparently vulnerable, and users are advised to upgrade to version 25.12.10.01 or newer, as soon as possible. This version includes fixes for download path management, message processing, and command encryption, which plug the hole. Gigabyte is yet to publish a standalone security bullet, but users can find the latest version of the software in its standard distribution channels.
Via BleepingComputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
https://cdn.mos.cms.futurecdn.net/G8QNviZt3KrDbfWVANJrNM-1920-80.jpg
Source link
