ASUS Armoury Crate CVE-2025-9336

Requires local access with at least low-level privileges (PR:L) and the ASUS Armoury Crate App with the vulnerable AsIO3.sys kernel driver installed and loaded - i.e., an ASUS system running Armoury Crate. The attacker must be able to reach the driver's device interface to submit crafted/malformed input (typically an IOCTL). Limiting factors: no remote vector (AV:L, cannot be exploited over a network), no user interaction needed (UI:N), and the confirmed impact is a system crash rather than data compromise; exploitation presupposes an existing local foothold on a machine with this specific vendor utility installed.

This is a local availability-only vulnerability whose signals converge on low real-world priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation requires local access and some existing low privileges, with impact limited to the vulnerable system's availability (VA:H; VC:N/VI:N - no confidentiality or integrity impact), consistent with a driver crash (BSOD). EPSS is very low at 0.15% (3rd percentile), the CVE is NOT on CISA KEV, and no public exploit was referenced, so there is no evidence of exploitation. One tension to flag: the description's phrase 'or other potentially undefined execution' hints at possible code execution, which would normally raise integrity/confidentiality impact, yet the official CVSS 4.0 vector scores both VC and VI as None and only VA:H - so the vendor-assessed outcome is denial of service, not confirmed privilege escalation. Because AsIO3.sys is a kernel-mode driver, stack overflows in such drivers are historically attractive for local privilege escalation and are frequently abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks; however, that is a general pattern and is not confirmed by the data here. Net assessment: medium severity, low urgency - patch in normal cycles rather than emergency.

A low-privileged local user (or malware already running on the host) sends crafted input to the AsIO3.sys kernel driver via its device interface, overflowing a stack buffer and crashing the system (BSOD). No public exploit code was identified; the primary demonstrated outcome is denial of service, though kernel-driver overflows can potentially be developed toward code execution.