CVE-2026-4416 describes an Insecure Deserialization vulnerability within the Performance Library component of Gigabyte Control Center. Authenticated local attackers can exploit this flaw by sending a malicious serialized payload to the EasyTune Engine service, leading to privilege escalation. Rated 7.8 HIGH, the vulnerability has a low attack complexity and requires no user interaction, posing a high impact to confidentiality, integrity, and availability. Currently, there is no public exploit code available, and it is not known to be actively exploited, nor is it listed on the CISA KEV catalog. However, it has garnered minor community discussion across social platforms.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 25.12.31.01CPE matchmatch criteria | cpe:2.3:a:gigabyte:performance_library:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.