Armoury Crate CVE-2026-16004

Exploitation requires an interactive local user-level account on a Windows system with Armoury Crate and its kernel driver actively installed and loaded. The attacker must craft IOCTL requests that bypass the driver's internal verification logic, which demands moderate reverse-engineering effort (reflected by AC:H in the provided CVSS 4.0 vector). No network access is required, no elevation of privilege is needed prior to exploitation, and no interaction from another user is necessary. Exploitation is bounded to systems where Armoury Crate is installed - non-ASUS hardware or ASUS systems where the software has not been installed or has been removed are not affected. The high attack complexity (AC:H) limits opportunistic or scripted mass exploitation.

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) accurately characterizes the constrained attack surface: exploitation is local, requires low privilege, but demands non-trivial reverse engineering of the driver's bypass condition (AC:H). The high integrity and availability sub-scores are well-supported - arbitrary PCI config writes can corrupt device configurations or crash the host - while the low confidentiality score (VC:L) correctly reflects that PCI config reads expose hardware layout rather than user secrets. There is no CISA KEV listing and no public exploit code in the available intelligence, keeping real-world urgency moderate. EPSS data was not provided; exploitation probability is inferred as low given the attack complexity requirement and the need for local foothold. The primary realistic threat actor is a malicious insider or a local privilege-escalation chain where this serves as a stepping stone to DMA-based kernel compromise. Organizations with shared ASUS gaming lab or development systems present a more relevant exposure surface than typical enterprise environments.

A low-privileged local user on an ASUS gaming workstation with Armoury Crate installed writes a proof-of-concept tool that probes the driver's IOCTL interface, identifies the verification bypass condition through trial-and-error or disassembly of the driver binary, and sends a crafted DeviceIoControl request. The attacker targets a DMA-capable PCIe device's BAR registers, reconfiguring its memory-mapped I/O window to overlap with kernel memory - potentially enabling arbitrary kernel reads or writes and facilitating full privilege escalation. No public POC code has been identified at time of analysis.