SignalRGB driver flaws enable BYOVD attacks
Two vulnerabilities in the SignalRGB kernel driver allow local users to access privileged hardware operations or crash the kernel; version 1.3.7.0 fixes both.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Researchers identified two vulnerabilities in SignalIo.sys, the kernel-mode driver used by the SignalRGB Windows application for RGB lighting control and hardware monitoring. CVE-2026-8049 stems from an overly permissive device object DACL, created without an SDDL security descriptor or FILE_DEVICE_SECURE_OPEN flag, allowing any authenticated local user to open a handle and issue privileged IOCTL commands, including read/write access to PCI configuration space. CVE-2026-8050 covers NULL pointer dereference conditions in seven of sixteen IOCTL handlers, which can be triggered by sending an empty input buffer, causing kernel crashes and denial of service.
While the driver includes a kernel-enforced port whitelist that limits some high-risk I/O operations, the underlying access control weakness still exposes privileged functionality to unprivileged processes, a pattern relevant to Bring Your Own Vulnerable Driver (BYOVD) attack techniques where attackers exploit legitimately signed drivers to gain kernel-level primitives. SignalRGB has released version 1.3.7.0 to remediate both issues. CERT/CC recommends updating to the patched driver, restricting administrative privileges, applying Microsoft's driver block rules, and enabling WDAC or equivalent EDR protections to reduce BYOVD exposure.
This is a vendor-disclosed vulnerability report with no evidence of active exploitation; the primary risk is theoretical abuse by local attackers or potential future incorporation into BYOVD toolkits used by ransomware or other kernel-level attack chains.
Mentioned in this report
Detection guidance
SignalRGB Vulnerable Driver Loaded From Non-Standard Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SignalIo.sys being loaded as a kernel driver from a path outside the standard SignalRGB installation directory, a common BYOVD staging pattern where attackers drop a legitimately signed vulnerable driver elsewhere to load it and exploit its permissive DACL for privileged IOCTL access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SignalRGB Vulnerable Driver Loaded From Non-Standard Path
description: Detects loading of the SignalIo.sys kernel driver (used by SignalRGB,
vulnerable to CVE-2026-8049/8050) from a location other than the standard SignalRGB
install path. BYOVD attacks typically stage a legitimately signed vulnerable driver
in a writable or unusual directory before loading it to obtain a privileged kernel
handle.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \SignalIo.sys
filter_standard_path:
ImageLoaded|contains:
- \Program Files\SignalRGB\
- \Program Files (x86)\SignalRGB\
condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB installations that place the driver in a non-default install
directory
- Portable or per-user SignalRGB deployments in unusual but legitimate paths
level: high
id: 14418e3f-5582-5762-bb23-e6cb3bec4b30
status: experimental
author: Vorant
Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects registration of a kernel-mode driver service whose ImagePath references SignalIo.sys from a path outside the standard SignalRGB installation, indicating an attacker is loading the legitimately signed but vulnerable driver to gain a privileged, undetected kernel primitive (BYOVD). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory
description: Detects creation of a Windows service configured to load SignalIo.sys
as a kernel driver (Type=1, kernel driver) from a non-standard path. This mirrors
the BYOVD pattern of registering a legitimately signed vulnerable driver as a service
to evade code-signing/EDR checks and obtain kernel-level access via its overly permissive
device object.
tags:
- attack.stealth
- attack.t1211
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\
TargetObject|endswith: \ImagePath
Details|endswith: SignalIo.sys
filter_standard_path:
Details|contains:
- \Program Files\SignalRGB\
- \Program Files (x86)\SignalRGB\
condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB software updates or reinstalls that register the driver service
from a custom directory
level: high
id: 273ac46a-c9a3-507f-921f-a7e88d4d811c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/380058
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs