CVE-2026-8050 Details

A NULL pointer dereference vulnerability has been identified in the SignalRGB kernel driver, 'SignalIo.sys', in versions prior to 1.3.7.0. This vulnerability arises because seven of the thirteen IOCTL handlers dereference the 'SystemBuffer' pointer without verifying that it is non-NULL. Sending an IOCTL with an empty input buffer causes a NULL pointer dereference, leading to a kernel crash. The vulnerability allows authenticated local users to trigger repeated kernel crashes, causing a denial-of-service condition.

Users are advised to update to SignalRGB version 1.3.7.0 or later, where this vulnerability has been addressed. Organizations should also implement mitigations to reduce exposure to 'Bring Your Own Vulnerable Driver' attacks, such as restricting administrative privileges and enabling protections like Windows Defender Application Control or an equivalent endpoint detection and response solution.