Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
Insufficient authorization enforcement in the Credentials Manager of Nozomi Networks Guardian and CMC (Central Management Console) permits a remote authenticated user with limited privileges to view, delete, or modify credential entries beyond their intended access scope. Affected deployments running Guardian or CMC prior to version 26.3.0 are exposed to disruption of OT/ICS device authentication when entries are deleted, and to potential indirect credential capture when entry properties such as the authentication target are manipulated to redirect authentication attempts to attacker-controlled infrastructure. No public exploit code or CISA KEV listing exists; a vendor patch is available as of version 26.3.0.
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. No public exploit or active exploitation has been identified; a fix has been committed to the WordPress.org plugin repository (changeset 3656930).
The /chat WebSocket endpoint in n8n workflow automation platform fails to validate that a supplied resumeToken targets a chat-compatible node, allowing any holder of a valid token - including anonymous form submitters - to bypass Send-and-Wait, non-chat Human-in-the-Loop (HITL), and Wait approval gates in paused workflow executions. Affected versions are n8n below 2.37.7 and n8n 2.38.0-2.38.1, with vendor-confirmed fixes released 2026-09-02. No public exploit code or CISA KEV listing exists at time of analysis, but the integrity impact is directly relevant to organizations relying on n8n for sensitive human-approval workflows.
Stored cross-site scripting in OpenSearch Dashboards' Vega visualization engine allows an authenticated user with dashboard write permissions to plant malicious JavaScript that executes in the browser session of any user who subsequently views the crafted dashboard. The `checkForFunctionProperty` input validation routine failed to recurse into arrays of objects, so a JavaScript function nested within an array structure silently bypassed sandbox enforcement. Fixed in versions 2.19.5 (2.x branch) and 3.6.0 (3.x branch) per AWS security bulletin 2026-102; no public exploit code or CISA KEV listing identified at time of analysis.
Path traversal in n8n's Elasticsearch and ElasticSecurity workflow nodes allows a low-privileged workflow editor to escape the intended Elasticsearch index scope and reach arbitrary indices or cluster administration endpoints using the platform's stored Elasticsearch credentials. Exploitation requires the ability to create or edit workflows containing Elasticsearch nodes, and the root cause is the absence of proper URL path-segment encoding (toPathSegment) in GenericFunctions.ts before identifiers are interpolated into REST request paths. No public exploit code or CISA KEV listing is present at time of analysis, but the scope change to a backend Elasticsearch cluster elevates the real-world impact beyond the CVSS base score suggests.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Concrete CMS versions below 9.5.3 leaks restricted sub-block configuration values - including Google Maps API keys - to unauthenticated visitors on public pages. The asset and header registration pipeline processes sub-blocks nested in Stacks, Containers, and layout areas without verifying whether the requesting user holds permission to view each sub-block, so configuration output emitted by those hooks reaches any visitor regardless of block-level restrictions. No active exploitation or public proof-of-concept has been identified; the vendor-assigned CVSS 4.0 score of 6.3 reflects a partial attack prerequisite (AT:P), limiting real-world exposure to sites that specifically combine public pages, nested restricted sub-blocks, and blocks whose hooks emit sensitive configuration values.
Webhook signature verification in n8n's GitHub Trigger node fails open when GitHub returns HTTP 422 during webhook registration, causing the platform to reuse an existing webhook while silently discarding the generated secret. Workflow static data then retains a webhookId with no corresponding webhookSecret, and the X-Hub-Signature-256 validation logic accepts any inbound delivery unconditionally, allowing network attackers to inject forged GitHub events and trigger arbitrary workflow executions. Versions prior to 1.123.76 (v1.x), 2.37.7 (v2.x), and 2.38.2 (v2.38.x) are affected; no public exploit or CISA KEV listing has been identified.
Incorrect Authorization (CWE-863) in Adobe Acrobat Reader and Acrobat 2024 allows unauthorized write access by bypassing document-level security restrictions when a victim opens a specially crafted PDF file. The CVSS scope-change indicator (S:C) signals the unauthorized write can escape the Acrobat process boundary and affect components outside the application itself, amplifying real-world impact beyond the medium base score. No public exploit has been identified and the vulnerability is not currently listed in the CISA KEV catalog.
Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis.
Cross-site scripting in HTML::FormHandler before 0.410000 (Perl/CPAN) allows unauthenticated network attackers to inject arbitrary JavaScript by submitting markup to any form field that triggers a validation error message embedding the submitted value. The library's rendering roles - Render::Simple, Render::Table, and Widget::Form::Simple - interpolate error strings directly into HTML error spans without entity encoding, so fields using check regexps, check lists, or type constraints expose the reflected XSS path. A stored XSS variant is also possible when applications persist and later re-render rejected form values. No public exploit is identified; vendor-released patch 0.410000 is available.
Cross-site scripting in HTML::FormHandler before 0.410002 for Perl allows unauthenticated remote attackers to inject JavaScript into rendered pages when application field attributes are derived from user-controlled data. The root cause is the `process_attrs` method in `HTML/FormHandler/Render/Util.pm`, which formats attribute key-value pairs via `sprintf('%s="%s"', $attr, $value)` without encoding, letting a double-quote character break out of the attribute context and inject event handlers. The fix - encoding double quotes and ampersands via `HTML::Entities::encode_entities` - is confirmed merged and released as version 0.410002 on CPAN.
Stored and reflected cross-site scripting in HTML::FormHandler before 0.410002 (Perl/CPAN) allows attacker-influenced text in form option labels to execute arbitrary JavaScript in victims' browsers. The Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets passed group labels and individual option labels directly into rendered HTML without applying HTML encoding, meaning any application that builds option lists from database records, user submissions, or dynamic sources exposes those label values as live markup. No public exploit code has been identified, but the patch commit and oss-security disclosure provide full technical detail on the affected rendering paths.
Reflected XSS in HTML::FormHandler before 0.410002 allows unauthenticated network attackers to inject JavaScript into rendered Perl web application pages by submitting form input containing script content. The Table form layout and Bootstrap 2 and 3 wrappers interpolated error strings - including rejected field values - directly into HTML without HTML-entity encoding, an incomplete fix relative to CVE-2026-19872 (which patched equivalent paths in other layouts in version 0.410000). No public exploit is identified and EPSS is 0.19%; risk is limited to applications using the three affected widget modules.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Cross-site scripting in Silverpeas Core <=6.4.6 enables attackers to inject malicious JavaScript via the Multimedia library application's introduction field, executing arbitrary scripts in victim users' browser contexts. The scope-changed CVSS vector (S:C) confirms the payload crosses security boundaries, affecting any authenticated user who views the injected library introduction. No active exploitation is confirmed and the EPSS score of 0.15% at the 4th percentile reflects very low current exploitation probability.
Cross-site scripting in Silverpeas Core <=6.4.6 allows script injection through the CKEditor WYSIWYG image upload feature, executing attacker-controlled JavaScript in victims' browsers. The scope-changed (S:C) vector confirms the injected script runs in a different origin context, enabling session theft, credential harvesting, or malicious UI redirection against authenticated platform users. EPSS stands at 0.15% (4th percentile), indicating minimal observed exploitation activity; no public exploit code or CISA KEV listing exists at time of analysis.
Cross-site scripting in Silverpeas Core 6.4.6 exposes other authenticated users to session hijacking or credential theft via the document management file upload feature. The scope-changed CVSS vector (S:C) confirms the injected script executes in a different security context than the upload origin, enabling impact beyond the uploading user's own session. No public exploit or active exploitation has been confirmed; EPSS at 0.15% (4th percentile) indicates very low current exploitation probability.
Reflected cross-site scripting in Adobe ColdFusion 2025 (through Update 12) and ColdFusion 2023 (through Update 23) enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The scope-changed nature of this flaw (S:C) confirms the vulnerability crosses the server's trust boundary into the victim's browsing session, enabling session token theft, credential harvesting, or forced UI manipulation. Adobe's APSB26-119 security bulletin addresses this vulnerability; no active exploitation (KEV) or public exploit code has been identified at time of analysis.
Privilege escalation in AlgoSec Horizon Security Analyzer (versions A33.10/A33.20/A33.30 on Linux 64-bit) allows a low-privileged local user to gain elevated - likely root - access by injecting malicious parameters into a command approved in the sudoers file. The root cause (CWE-266, Improper Privilege Management) is insufficient restriction of arguments permitted when invoking the sudo-approved command, enabling a classic parameter injection attack. No public exploit code is identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Nginx directive injection in Okta Access Gateway before version 2026.9.1 enables an authenticated administrator to inject arbitrary nginx directives into the gateway's server block by exploiting the application-level custom configuration field, which bypasses the Lua-based restriction mechanism applied to other directive entry points. The field is interpolated directly into the nginx server block without validation, allowing manipulation of routing, access controls, and header processing with high integrity impact. Vendor-released patch version 2026.9.1 is available; no public exploit has been identified at time of analysis.
OIDC SSO authentication bypass in n8n Enterprise allows users with credentials in a previously configured but administratively disabled identity provider to obtain valid application sessions. The public OIDC login and callback endpoints in `packages/cli/src/modules/sso-oidc/oidc.service.ee.ts` lacked an `assertOidcLoginEnabled` guard, meaning disabling OIDC at the n8n configuration level did not actually deactivate the protocol handler. Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2 per GitHub Security Advisory GHSA-pf83-w3f9-8m37; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows a network-connected attacker with high database privileges to corrupt heap memory, causing at minimum a denial-of-service crash of the SQL Server process and potentially enabling code execution. Affects SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing identified at time of analysis, though the description's claim of code execution potential warrants close attention despite vendor CVSS metrics reflecting only availability impact.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.
Filesystem junction abuse during uninstallation of Okta Verify for Windows (versions 5.1.3 through 6.x) allows a low-privileged local user to trigger arbitrary recursive directory deletion with elevated privileges. The uninstaller fails to verify whether the user data directory is an NTFS junction point before deleting its contents as a privileged process, so a pre-positioned junction can redirect the elevated deletion to any directory reachable on the same volume. No public exploit code has been identified at the time of analysis, though this class of junction-based privilege abuse is well understood in Windows security research circles.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.
Field policy bypass in ash_ai (versions 0.1.0 through < 1.0.3) allows authenticated, low-privilege actors to read per-actor-restricted fields - including sensitive PII - by invoking the aggregate result type (min, max, sum, avg) via the LLM read tool instead of direct record retrieval. Ash field policies redact forbidden fields on returned records by substituting %Ash.ForbiddenField{}, but this redaction mechanism was never applied to aggregate code paths; the tool's authorization check only tested field.public?, a static attribute orthogonal to per-actor policy evaluation. Patch version 1.0.3 is available via the vendor advisory; no CISA KEV listing or public exploit code has been identified at time of analysis.
Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.
Denial of service in MongoDB Server allows any authenticated user - including those with only read-only privileges - to crash the mongod process by exploiting an internal aggregation expression that was incorrectly registered as user-accessible rather than restricted to internal cluster operations. Submitting a malformed index specification within this expression triggers an assertion failure (CWE-617) in the index key generation code path. In affected build configurations, this assertion failure terminates the mongod process, severing all active client connections. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low privilege requirement (read-only user) makes this a realistic insider or compromised-credential threat.
Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Credential exfiltration in n8n's Log Streaming subsystem allows an authenticated user holding a custom global role with Log Streaming scopes to decrypt and exfiltrate credentials belonging to any other project. The authorization check in destination-credentials-access.ts performs a credential:read scope check but omits an ownership or project-membership check, so any credential ID can be referenced regardless of which project owns it. No public exploit has been identified at time of analysis, but the impact is high-confidentiality for any secret stored in the platform because the decrypted value is sent directly to an attacker-controlled HTTP endpoint.
Arbitrary file write in Okta Access Gateway (all versions before 2026.9.1) allows a highly privileged authenticated attacker to direct the Kerberos configuration handler to write files to arbitrary locations on the appliance filesystem by supplying a path traversal string in an event payload. The root cause is CWE-73 (External Control of File Name or Path): the handler uses the payload-supplied path directly as the write destination without sanitization or canonicalization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model.
Denial of service against Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 builds is achievable by unauthenticated remote attackers via unthrottled resource allocation (CWE-770). High attack complexity (AC:H) limits trivial or automated exploitation, and SSVC assessment confirms no active exploitation and non-automatable attack patterns. Only availability is impacted; confidentiality and integrity are unaffected. Vendor patch is available through Microsoft MSRC; no public exploits have been identified.
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Server-side request forgery in Snipe-IT before 8.7.0 allows a super-admin to bypass the ExternalUrl webhook SSRF guard by supplying IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. The validation logic only checks IPv4 address representations, so transition-encoded addresses such as 64:ff9b::169.254.169.254 pass unchallenged, enabling the server to reach internal services or cloud metadata endpoints like the AWS IMDSv1 API. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is version 8.7.0.
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly manipulate PCIe configuration space, enabling both hardware configuration disclosure and hardware disablement. The vulnerability stems from the kernel driver accepting IOCTL requests without validating caller privilege against the required access level, granting unprivileged processes read and write access to raw PCIe registers. No public exploit code has been identified at time of analysis, and no KEV listing exists, though the local nature of the attack limits the attack surface to already-compromised or multi-user systems.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system crashes (BSOD) and corrupt kernel data structures. The driver's IOCTL handling fails to validate pointer references before releasing memory, and an attacker can bypass this verification to free arbitrary kernel memory via a crafted IOCTL request. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.8 reflects the local, high-complexity attack surface.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis.