SignalRGB driver flaws enable BYOVD attacks
Two vulnerabilities in the SignalRGB kernel driver allow local users to access privileged hardware operations or crash the kernel; version 1.3.7.0 fixes both.
Researchers identified two vulnerabilities in SignalIo.sys, the kernel-mode driver used by the SignalRGB Windows application for RGB lighting control and hardware monitoring. CVE-2026-8049 stems from an overly permissive device object DACL, created without an SDDL security descriptor or FILE_DEVICE_SECURE_OPEN flag, allowing any authenticated local user to open a handle and issue privileged IOCTL commands, including read/write access to PCI configuration space. CVE-2026-8050 covers NULL pointer dereference conditions in seven of sixteen IOCTL handlers, which can be triggered by sending an empty input buffer, causing kernel crashes and denial of service.
While the driver includes a kernel-enforced port whitelist that limits some high-risk I/O operations, the underlying access control weakness still exposes privileged functionality to unprivileged processes, a pattern relevant to Bring Your Own Vulnerable Driver (BYOVD) attack techniques where attackers exploit legitimately signed drivers to gain kernel-level primitives. SignalRGB has released version 1.3.7.0 to remediate both issues. CERT/CC recommends updating to the patched driver, restricting administrative privileges, applying Microsoft's driver block rules, and enabling WDAC or equivalent EDR protections to reduce BYOVD exposure.
This is a vendor-disclosed vulnerability report with no evidence of active exploitation; the primary risk is theoretical abuse by local attackers or potential future incorporation into BYOVD toolkits used by ransomware or other kernel-level attack chains.
Mentioned in this report
Detection guidance
SignalRGB Vulnerable Driver Loaded From Non-Standard Path
Detects SignalIo.sys being loaded as a kernel driver from a path outside the standard SignalRGB installation directory, a common BYOVD staging pattern where attackers drop a legitimately signed vulnerable driver elsewhere to load it and exploit its permissive DACL for privileged IOCTL access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SignalRGB Vulnerable Driver Loaded From Non-Standard Path
description: Detects loading of the SignalIo.sys kernel driver (used by SignalRGB,
vulnerable to CVE-2026-8049/8050) from a location other than the standard SignalRGB
install path. BYOVD attacks typically stage a legitimately signed vulnerable driver
in a writable or unusual directory before loading it to obtain a privileged kernel
handle.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \SignalIo.sys
filter_standard_path:
ImageLoaded|contains:
- \Program Files\SignalRGB\
- \Program Files (x86)\SignalRGB\
condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB installations that place the driver in a non-default install
directory
- Portable or per-user SignalRGB deployments in unusual but legitimate paths
level: high
id: 14418e3f-5582-5762-bb23-e6cb3bec4b30
status: experimental
author: Vorant
Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory
Detects registration of a kernel-mode driver service whose ImagePath references SignalIo.sys from a path outside the standard SignalRGB installation, indicating an attacker is loading the legitimately signed but vulnerable driver to gain a privileged, undetected kernel primitive (BYOVD). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory
description: Detects creation of a Windows service configured to load SignalIo.sys
as a kernel driver (Type=1, kernel driver) from a non-standard path. This mirrors
the BYOVD pattern of registering a legitimately signed vulnerable driver as a service
to evade code-signing/EDR checks and obtain kernel-level access via its overly permissive
device object.
tags:
- attack.defense-evasion
- attack.t1211
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\
TargetObject|endswith: \ImagePath
Details|endswith: SignalIo.sys
filter_standard_path:
Details|contains:
- \Program Files\SignalRGB\
- \Program Files (x86)\SignalRGB\
condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB software updates or reinstalls that register the driver service
from a custom directory
level: high
id: 273ac46a-c9a3-507f-921f-a7e88d4d811c
status: experimental
author: Vorant
Kernel Bugcheck Referencing SignalIo.sys Driver
Detects a Windows kernel crash (bugcheck) report naming SignalIo.sys as the faulting module, consistent with triggering the NULL pointer dereference DoS condition (CVE-2026-8050) via malformed IOCTL input to the vulnerable driver. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Bugcheck Referencing SignalIo.sys Driver
description: Detects Windows Error Reporting bugcheck/crash events that identify SignalIo.sys
as the faulting driver module. This pattern is consistent with exploitation of the
NULL pointer dereference IOCTL handler vulnerability (CVE-2026-8050) causing a kernel
crash / denial of service, as opposed to routine hardware or driver instability
unrelated to this component.
tags:
- attack.impact
- attack.t1499
logsource:
product: windows
category: application
detection:
selection:
Provider_Name: Microsoft-Windows-WER-SystemErrorReporting
EventID: 1001
driver_match:
Message|contains: SignalIo.sys
condition: selection and driver_match
falsepositives:
- Unrelated driver instability coincidentally logged near the same time as SignalRGB
usage
- Hardware failures unrelated to the SignalIo.sys driver but sharing generic bugcheck
codes
level: medium
id: be5b9f13-5463-567e-859c-c7f62b410b56
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/380058
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free