Read the docs
TI-2026-03835 Aliases CVE-2026-4415GHSA-hvj3-h37v-8xmq

GIGABYTE｜Gigabyte Control Center - Arbitrary File Write

Priority MEDIUM 44CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01004 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GIGABYTEGigabyte Control Centerup to 25.07.21.01—No fix listedCNA
  • Gigabyte Control Center VendorGIGABYTE Affected up to 25.07.21.01 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gigabyte:control_center:*:*:*:*:*:*:*:*before 25.12.10.01VulnerableGIGABYTE
  • cpe:2.3:a:gigabyte:control_center:*:*:*:*:*:*:*:* Versions before 25.12.10.01 Vulnerable ·GIGABYTE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4415
  2. 2026-10-03 Alias added: GHSA-hvj3-h37v-8xmq

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences