Armoury Crate CVE-2026-16006

Exploitation requires local interactive access to a Windows system with the Armoury Crate kernel driver installed and loaded - a standard (low-privileged) user account is sufficient; no administrative rights are needed. The attacker must be able to open the driver's device object handle and issue IOCTL calls, which necessitates a local logon or Remote Desktop session; remote, unauthenticated network exploitation is not possible given AV:L. High attack complexity (AC:H per CVSS 4.0) indicates the crafted IOCTL must precisely meet conditions to bypass the driver's verification routine, adding a non-trivial technical bar. This vulnerability alone does not grant privilege escalation or code execution - it discloses kernel address information useful for defeating KASLR only when combined with a separate vulnerability. Systems on which only administrative accounts hold interactive logon rights are not meaningfully exposed to unprivileged exploitation.

The CVSS 4.0 score of 5.7 (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the vulnerability's constrained threat model: it requires a local interactive session with at least low-privileged access and exhibits elevated attack complexity, ruling out opportunistic or remote exploitation. The impact is confidentiality-only - no integrity or availability impact - which keeps it well below critical thresholds. The real strategic risk lies in its role as an enabler: kernel virtual addresses leaked this way function as a KASLR bypass primitive, the first link in a two-stage local privilege-escalation chain. Organizations managing ASUS gaming hardware across mixed-trust user pools - even a mid-sized municipal IT team in radom should treat this as a prompt, non-emergency patch - particularly on shared workstations where standard users have interactive logon rights. High complexity (AC:H) limits scripted, mass exploitation, but a targeted actor with driver-auditing capability could leverage this deterministically. No public exploit exists and it does not appear in CISA KEV, consistent with a low-to-moderate EPSS risk profile (EPSS value not provided in input).

A standard Windows user on an ASUS gaming workstation opens the Armoury Crate driver's device handle and sends a specially crafted IOCTL request that satisfies the bypass condition in the driver's verification logic, causing the driver to return kernel virtual address values to user space. The attacker uses those addresses to compute the runtime kernel base, defeating KASLR, then combines this information with a separate kernel memory-corruption vulnerability to escalate privileges. No public exploit code for this specific bypass has been identified at time of analysis.