GIGABYTE Control Center vulnerability allows remote code execution

As outlined in Bleeping Computer, a critical arbitrary file-write vulnerability has been discovered in GIGABYTE's Control Center (GCC) software, potentially exposing users to severe security risks. This flaw could allow unauthenticated attackers to gain control over vulnerable systems.

The vulnerability, tracked as CVE-2026-4415 and rated with a critical severity of 9.2 out of 10, resides in the "pairing" feature of GCC versions 25.07.21.01 and earlier. When this feature is enabled, remote attackers can write arbitrary files to any location on the operating system. Successful exploitation could lead to arbitrary code execution, privilege escalation, or denial-of-service conditions. The GCC utility is pre-installed on GIGABYTE laptops and motherboards, managing hardware monitoring, fan control, RGB lighting, and driver updates.

GIGABYTE has released version 25.12.10.01 of the Control Center to address this vulnerability, recommending immediate upgrades. Users are advised to download the latest version from GIGABYTE's official software portal to avoid compromised installers.

Source: Bleeping Computer