EUVD-2026-104782
GHSA-978r-3cgq-4j3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local account
-
DeliveryPlant malicious DLL in search path
-
ExploitTrigger high-privilege Armoury Crate process
-
ExecutionDLL loaded, code runs as SYSTEM
-
ImpactFull host compromise / privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Requires the attacker to already have local code-execution ability as a low-privileged user (PR:L) on a system running ASUS Armoury Crate, plus write access to a directory that appears earlier in the DLL search order than the legitimate library loaded by the high-privilege Armoury Crate component. Exploitation is limited by these prerequisites: it is local only (AV:L), cannot be performed remotely or unauthenticated, and depends on the vulnerable high-privilege process actually loading the hijacked DLL (typically at service/process start). No user interaction by a victim is needed (UI:N). Non-ASUS systems and machines without Armoury Crate installed are unaffected. |
| Impact | This is a credible but not emergency-tier priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.5) is internally consistent with the description: a local, low-privilege user (PR:L) with no user interaction exploits DLL search-order hijacking (CWE-427) to gain full confidentiality/integrity/availability impact - i.e. SYSTEM-level code execution. The high score is driven by the complete impact (local privilege escalation to SYSTEM), not by remote reach - AV:L means the attacker must already have a foothold on the machine. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The 'RCE' tag overstates the vector: this is local privilege escalation / local code execution, not remote code execution, since the CVSS vector is explicitly AV:L. Net assessment: a real, patch-worthy local privilege-escalation flaw on ASUS consumer hardware, but it requires pre-existing local access and is not a mass-exploitable internet-facing issue; prioritize patching on shared or multi-user ASUS systems over isolated single-user machines. |
| Exploit ScenarioDerived | An attacker who already has a standard (non-administrator) local account on an ASUS Windows machine plants a malicious DLL in a directory searched before the legitimate one by an Armoury Crate high-privilege process. When that SYSTEM-level process starts or reloads, it loads the attacker's DLL instead, executing arbitrary code as SYSTEM and escalating from low privileges to full system control. No public exploit code is referenced, but DLL-hijacking primitives of this class are well understood and straightforward to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
ASUS Armoury Crate on Windows loads at least one dynamic-link library by name without a fully qualified path, so a local attacker who can write to a directory that precedes the legitimate library in the Windows DLL search order can plant a malicious DLL and have it loaded by a high-privilege Armoury Crate component, yielding arbitrary code execution at SYSTEM integrity. The flaw (CWE-427) is local-only: the attacker must already hold low-privileged code execution on the host (CVSS:4.0 AV:L/PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5 CVSS 4.0 base) and must be able to write to the hijackable path; the payload then runs when the privileged process or service next starts, with no victim interaction required. Only machines with Armoury Crate installed are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a credible but not emergency-tier hardening/patching priority for gaming laptops, desktops and ROG/TUF motherboard owners.
RemediationAI
Install the current Armoury Crate release from ASUS and apply the 'Security Update for Armoury Crate App' guidance at https://www.asus.com/security-advisory; the provided data does not specify an exact fixed build number, so verify the installed version in Armoury Crate's update/About panel against the advisory rather than assuming any particular version is patched. Where immediate updating is not possible, treat this as an ACL and search-path hardening problem: use icacls to remove write permissions for standard users (and for the Everyone/Authenticated Users groups) on the Armoury Crate installation directory, its subfolders, and the folders containing its privileged service binaries, so no user-writable directory precedes the legitimate DLL in the loader search order - the trade-off is that restrictive ACLs can break Armoury Crate's self-updater, which may then require an administrator to run updates manually. Audit the machine and system PATH for user-writable directories and remove them (this can break user-installed tooling that depends on those paths), and ensure the ASUS service runs only from an administrator-owned directory. On hosts where Armoury Crate is not actually needed, uninstalling it removes the attack surface entirely, at the cost of losing fan-curve, RGB and profile control. As detection and containment, monitor for newly created or renamed DLLs in Armoury Crate program folders and for unexpected module loads into the privileged Armoury Crate process/service, and restrict interactive logon and local administrator rights to the minimum set of users so a low-privileged foothold is harder to obtain in the first place.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-427 (Uncontrolled Search Path Element) is a Windows loader weakness: when a process calls LoadLibrary/LoadLibraryEx with a bare filename, or relies on a dependent-DLL search, the loader walks a defined search order (application directory, system directories, current working directory, %PATH% entries, and so on). If any directory earlier in that order is writable by a non-administrative user - for example a user-writable subfolder under the application tree, a per-user install path, or a directory placed on the system PATH - an attacker can drop a DLL of the expected name and have it mapped into the address space of the loading process. Because the affected Armoury Crate component runs as a privileged Windows service/process (SYSTEM), the planted library inherits SYSTEM integrity, giving full read/write/execute over the host. Successful exploitation is therefore a local privilege-escalation primitive chained from an existing low-privilege foothold rather than a remote entry point; the timing dependency on the privileged component (re)starting is what typically turns a dropped DLL into actual code execution. Armoury Crate is the Windows control plane for ASUS ROG/TUF laptops, desktops and motherboards (fan curves, RGB, performance profiles, driver/BIOS updates), which is why its privileged helper components are broadly deployed on consumer gaming hardware. No CPE strings were supplied with this record, so exact affected build ranges beyond the vendor's 'Security Update for Armoury Crate App' section cannot be enumerated from the available data.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL hijacking (AV:L) by an existing low-privilege user (PR:L) with no interaction yields SYSTEM-level code execution, so C/I/A all High; scope unchanged as impact stays on the host.
Primary rating from Vendor (54bf65a7-a193-42d2-b1ba-8e150d3c35e1).
CVSS VectorVendor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
DescriptionCVE.org
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Articles & Coverage 1
Executive ViewAI
ASUS Armoury Crate, a management utility preloaded on many ASUS gaming laptops and desktops, contains a DLL search-order weakness that lets an attacker who already has a foothold on a machine escalate to SYSTEM-level control of the device. The exposure is limited to endpoints running Armoury Crate and cannot be triggered remotely or without existing local access, so it is a privilege-escalation and persistence risk rather than an entry point. Leadership should care because an attacker who lands on any gaming or developer laptop with this software can quietly convert limited access into full administrative control and durable presence on the fleet.
No vendor-released patch identified at time of analysis. Interim mitigations: remove write permissions for non-administrative users on Armoury Crate installation and data directories to close the hijackable path; enable Safe DLL search mode and enforce fully qualified paths via application-directory registry settings and service configuration review; uninstall or disable Armoury Crate where hardware control features are not required; apply application allowlisting and EDR monitoring for DLL loads from user-writable or unusual directories into Armoury Crate processes; and limit local interactive access and privilege sprawl on affected laptops.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB