Gigabyte warns users Control Center flaw could let hackers hijack your files

News
By published

A Windows utility tool was found vulnerable to a critical flaw

malware
(Image credit: Elchinator from Pixabay)
  • GIGABYTE Control Center carried critical CVE‑2026‑4415 vulnerability in its pairing feature
  • Flaw allowed unauthenticated remote attackers to write arbitrary files, execute code, and escalate privileges
  • Patch released in version 25.12.10.01; users urged to update immediately to secure affected systems

GIGABYTE Control Center, a Windows utility which comes preloaded with certain computers, carried a critical-severity vulnerability that allowed malicious actors to access files, run code, and trigger denial-of-service conditions on affected devices.

The bug has now been addressed and users are advised to patch up without delay.

GIGABYTE is a major hardware manufacturer known for, among other things, PC motherboards. It also built and maintains GIGABYTE Control Center, a utility program for PCs powered by its motherboards. Inside, users can manage and configure different hardware components, such as fans, RGB lights, driver and firmware updates, and more.

Article continues below

"Pairing" is to blame

One of its features, called ‘pairing’ was the root cause of this issue. Pairing is a feature that allows Control Center to communicate with other devices over a network.

“When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation,” the National Vulnerability Database explained.

Some sources claim the attack does not require user interaction or prior authentication, which would make it more dangerous than your average, run-of-the-mill bug.

It is probably the reason why the bug, now tracked as CVE-2026-4415, was given a severity score of 9.2/10 (critical). It was first disclosed by Taiwan’s Computer Emergency Response Team (TWCERT/CC), who credited security researcher David Sprüngli for the discovery.

Versions 25.07.21.01 and earlier are apparently vulnerable, and users are advised to upgrade to version 25.12.10.01 or newer, as soon as possible. This version includes fixes for download path management, message processing, and command encryption, which plug the hole. Gigabyte is yet to publish a standalone security bullet, but users can find the latest version of the software in its standard distribution channels.

Via BleepingComputer

Best antivirus software header
The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.