CVE-2025-32776
OpenRazer Vulnerable to Out of Bounds Read
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenRazer Vulnerable to Out of Bounds Read
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
CVE-2025-32776- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-14704
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
EUVD-2025-14704- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
NVD
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
CVE-2025-32776- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
OpenRazer Vulnerable to Out of Bounds Read
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
CVE-2025-32776- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-32776
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
DEBIAN-CVE-2025-32776- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-32776
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the matrix_custom_frame file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
- Record
UBUNTU-CVE-2025-32776- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openrazerDebian:12 |
before 3.5.1+dfsg-2+deb12u1, plus listed versions 3.5.1+dfsg-2 |
3.5.1+dfsg-2+deb12u1 |
openrazerDebian:13 |
before 3.10.2+dfsg-1 | 3.10.2+dfsg-1 |
openrazerDebian:14 |
before 3.10.2+dfsg-1 | 3.10.2+dfsg-1 |
openrazerDebian:11 |
before 2.9.0+dfsg-1+deb11u1, plus listed versions 2.9.0+dfsg-1 |
2.9.0+dfsg-1+deb11u1 |
openrazerUbuntu:20.04:LTS |
All versions, plus listed versions 2.5.0+dfsg-1ubuntu2 |
None known |
openrazerUbuntu:22.04:LTS |
All versions, plus listed versions 2.9.0+dfsg-1ubuntu13.2.0+dfsg-3 |
None known |
openrazerUbuntu:24.04:LTS |
All versions, plus listed versions 3.4.0+dfsg-1ubuntu13.6.1+dfsg-13.7.0+dfsg-13.7.0+dfsg-1ubuntu0.13.7.0+dfsg-1ubuntu0.23.7.0+dfsg-1ubuntu0.3 |
None known |
openrazerUbuntu:25.10 |
All versions, plus listed versions 3.10.0+dfsg-13.10.2+dfsg-13.10.3+dfsg-2 |
None known |
openrazerUbuntu:26.10 |
All versions, plus listed versions 3.11.0+dfsg-13.12.1+dfsg-13.12.3+dfsg-13.12.4+dfsg-1 |
None known |
openrazerUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.3+dfsg-23.11.0+dfsg-13.11.0+dfsg-1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32776 is a medium vulnerability (CVSS 5.5) in Openrazer, published April 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in openrazer 3.5.1+dfsg-2+deb12u1.
References
github.com/openrazer/openrazer/security/advisories/GHSA-835j-6976-46jx
lists.debian.org/debian-lts-announce/2025/04/msg00032.html