SteelSeries GG for macOS Buffer Overflow Vulnerability Analysis (CVE-2026-39254/255)

Summary of Vulnerability Regarding Unsafe Device String Handling in SteelSeries GG for macOS Vulnerability Overview Vulnerability ID: CVE-2026-39254 and CVE-2026-39255 Researchers: Nir Yehoshua, Cipher Security Labs Release Date: August 2026 Affected Version: SteelSeries GG for macOS v107.0.0 Vulnerability Type: Buffer Overflow Vulnerability Description: - CVE-2026-39254: The function calls an unbounded using the format string , ignoring the target buffer size provided by the caller. - CVE-2026-39255: The function allocates memory after measuring the length of a wide string, then performs the copy using an unbounded . If the source string changes between measurement and copy, the allocated size will be insufficient. Impact Scope Prerequisites for Attack: Requires attacker-controlled HID data to reach the affected device processing path. CVE-2026-39255 additionally requires the source content to change between length measurement and subsequent copying. Potential Impact: May lead to heap corruption and process crashes, but code execution has not been proven. Remediation SteelSeries GG v108.3.0: - CVE-2026-39254: Replaced with bounded , passing the target buffer size. - CVE-2026-39255: Removed the and functions, as well as related HIDAPI exports. Technical Details CVE-2026-39254: - Root Cause: accepts a target buffer and size, zeroes the buffer using , reads up to 100 bytes of device-side data via , and then formats the output using instead of a bounded API. - Overflow Calculation: Assuming consists of 99 non-null bytes plus a terminator, writes 104 bytes (99 bytes for output plus 4 bytes for the suffix). For a 32-bit target, this results in a 72-byte overflow. - Proven Aspects: Unbounded format call, ignored size, deterministic overflow arithmetic. - Unproven Aspects: Physical malicious HID device reaching this sink end-to-end, or code execution. CVE-2026-39255: - Root Cause: copies a wide string during HID enumeration. The length is measured before allocation, but copies the current content of without an explicit boundary. If grows after and before , the heap allocation becomes too small. - Reachability: This helper function is called during HID device enumeration. The lab verified loading the actual , resolved , and triggered heap corruption via a mutable source/TOCTOU condition. - Runtime Evidence: AddressSanitizer reported a heap buffer overflow, with allocation attributed to . - Proven Aspects: Insecure sequence, enumeration reachability, heap corruption. - Unproven Aspects: End-to-end exploitation, physical malicious USB device, or long but stable HID string overflow. Patch Analysis CVE-2026-39254: - v107.0.0: Uses , where the caller ignores the size. - v108.3.0: Uses , where the caller passes the size. - Patch Logic: Replaces with bounded , passing the target buffer size. CVE-2026-39255: - v107.0.0: Contains and , with HIDAPI exports present in the enumeration path. - v108.3.0: Removed and ; HIDAPI exports removed from this dylib. Disclosure Timeline 2026-06-10: Reported to SteelSeries. 2026-06-15: Technical details shared with SteelSeries. 2026-07-31: SteelSeries reported fixes in v108.3.0; CSL verified both fixes. Conclusion Two trust boundary failures allowed device-influenced strings to reach unbounded C runtime sinks: unbounded with an ignored size parameter (CVE-2026-39254), and post-measurement copying of wide strings using (CVE-2026-39255). The strongest runtime signal is the vendor library heap overflow in ; CVE-2026-39254 is supported by static analysis and overflow arithmetic. SteelSeries GG v108.3.0 replaced the path with bounded and removed and from the affected enumeration surface. macOS users should update to v108.3.0 or later. References CVE-2026-39254 CVE-2026-39255 SteelSeries GG Download Cipher Security Labs Technical Appendix Binaries: - v107.0.0 (Vulnerable): , Mach-O 64-bit x86_64, SHA-256: - v108.3.0 (Fixed): , Mach-O 64-bit x86_64, SHA-256: CVE-2026-39254 Symbols and Offsets (v107.0.0): - Parent Dispatch: - Vulnerable Function: - Vulnerable Sink: at - Format String: - Fixed Sink (v108.3.0): at CVE-2026-39255 Symbols and Offsets (v107.0.0): - Vulnerable Function: - Vulnerable Sink: at - ASAN Allocation Site:

Goal Reached Thanks to every supporter — we hit 100%!

SteelSeries GG for macOS Buffer Overflow Vulnerability Analysis (CVE-2026-39254/255)

More from this source