OpenRazer Vulnerable to Out of Bounds Read

published 2025-04-15 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-14704

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.

Patch / fix

fixed in 1 distros 1 links 2

openrazer_project openrazer 3.10.2

openrazer Debian 12 3.5.1+dfsg-2+deb12u1
openrazer Debian 14, Debian 13 3.10.2+dfsg-1

debian advisories DEBIAN-CVE-2025-32776

github.com/openrazer/openrazer@5761051 commit
github.com/openrazer/openrazer@d869abd commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-15)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

openrazer openrazer

Classification

Weakness

CWE-125 Out-of-bounds Read

References

Sources

CVE List CVE-2025-32776
NVD CVE-2025-32776

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary