CVE-2026-4415

When the pairing feature is enabled in Gigabyte Control Center, the application does not verify the identity of the requester or the target file path. The vulnerability combines path traversal (CWE-23) and write outside intended buffer or location (CWE-787) characteristics, allowing an attacker to transmit any file over the network and place it in a selected operating system location. This results in the ability to inject malicious code in locations executed by the system or applications with elevated privileges.

An attacker can achieve remote code execution (RCE) on a vulnerable machine or escalate their privileges to system level, gaining full control over the host.

Patches available from the vendor should be applied according to references (https://www.twcert.org.tw/en/cp-139-10804-689cd-2.html). Until an update is applied, it is recommended to disable the pairing feature in Gigabyte Control Center and restrict network access to the application using a firewall.

Gigabyte Control Center — versions indicated in vendor references (TWCERT); vulnerability is active when the device pairing feature is enabled.