EUVD-2026-72621
GHSA-2f87-w97c-m89f
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with crafted IOCTL bypass required (AV:L/AC:H/PR:L); impact is kernel address disclosure only with no integrity or availability loss (S:U/C:H/I:N/A:N).
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
1DescriptionCVE.org
Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
AnalysisAI
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local interactive access to a Windows system with the Armoury Crate kernel driver installed and loaded - a standard (low-privileged) user account is sufficient; no administrative rights are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.7 (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the vulnerability's constrained threat model: it requires a local interactive session with at least low-privileged access and exhibits elevated attack complexity, ruling out opportunistic or remote exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Armoury Crate to the patched version identified in the ASUS Security Advisory at https://www.asus.com/security-advisory/; the exact patched version number is not specified in the available input data and must be confirmed from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Armoury Crate
View allASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which all
Local privilege escalation in ASUS Armoury Crate allows an authenticated low-privileged user to bypass driver validation
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a loca
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to by
Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system cr
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver auth
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user
Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode dr
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication a
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-cont
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, en
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today