Gigabyte Control Center vulnerable to unauthenticated RCE flaw

Gigabyte has patched a critical vulnerability in its Control Center software that allows remote attackers to write arbitrary files without authentication, potentially leading to full system compromise.

The flaw, tracked as CVE-2026-4415, carries a CVSS v4 score of 9.2 (critical) and affects widely used system management software on Gigabyte systems.

The issue was disclosed on March 30, 2026, by Taiwan’s Computer Emergency Response Team (TWCERT/CC), with security researcher David Spruengli credited for the discovery. According to the advisory, the vulnerability resides in the “pairing” feature of Gigabyte Control Center. When this feature is enabled, it exposes a mechanism that can be abused by unauthenticated remote attackers to write arbitrary files to any location on the underlying operating system. This behavior stems from a path-traversal vulnerability that allows attackers to bypass intended directory restrictions.

Successful exploitation could allow attackers to place malicious executables or overwrite critical system files, ultimately resulting in arbitrary code execution or privilege escalation. The attack does not require user interaction or prior authentication, significantly increasing its severity and making it suitable for automated exploitation in exposed environments.

Gigabyte Control Center is a system utility preinstalled or offered on many Gigabyte motherboards and laptops, providing users with centralized control over performance tuning, driver updates, RGB lighting, and system monitoring. Due to its deep integration with system components and elevated privileges, software vulnerabilities in it can have serious security implications.

The flaw affects Gigabyte Control Center version 25.07.21.01 and earlier. Users are advised to update to version 25.12.10.01 or later, which addresses the issue. At the time of writing, Gigabyte has not published a standalone security bulletin, but the patched version has been made available through its software distribution channels.

Alongside this critical issue, Gigabyte also fixed a separate high-severity vulnerability (CVE-2026-4416) in the Performance Library component of Control Center. This flaw, also reported by Spruengli, involves insecure deserialization in the EasyTune Engine service, allowing authenticated local attackers to execute code with elevated privileges. It has been resolved in version 25.12.31.01.

Users should immediately update Gigabyte Control Center to the latest available version and disable the pairing feature if not required. Additionally, limiting network exposure of management interfaces and monitoring systems for unexpected file changes can help reduce the risk of exploitation.