Razer Synapse vulnerabilities

CVE-2017-9769 [CRITICAL] CVE-2017-9769: A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that i A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.

CVE-2025-9869 [HIGH] CWE-59 CVE-2025-9869: Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerabi Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists

CVE-2025-9871 [HIGH] CWE-59 CVE-2025-9871: Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnera Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exis

CVE-2025-9870 [HIGH] CWE-59 CVE-2025-9870: Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. Th Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific

CVE-2022-47631 [HIGH] CWE-367 CVE-2022-47631: Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects

CVE-2017-14398 [HIGH] CWE-119 CVE-2017-14398: rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory loc rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection.

CVE-2017-11652 [HIGH] CWE-732 CVE-2017-11652: Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file.

CVE-2021-44226 [HIGH] CWE-427 CVE-2021-44226: Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\ Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there.

CVE-2017-11653 [HIGH] CWE-732 CVE-2017-11653: Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll file.

CVE-2022-47632 [MEDIUM] CWE-427 CVE-2022-47632: Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Alth

CVE-2021-30494 [MEDIUM] CWE-276 CVE-2021-30494: Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged o Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended

CVE-2021-30493 [MEDIUM] CWE-276 CVE-2021-30493: Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged o Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended