EUVD-2026-50946
GHSA-479r-w7g7-fj9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-priv account
-
DeliveryStage crafted replacement file
-
ExploitTrigger privileged Armoury Crate operation
-
ExecutionWin TOCTOU race, swap file
-
PersistPrivileged process loads malicious content
-
ImpactExecute code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a pre-existing local, low-privileged account on a Windows system running ASUS Armoury Crate (CVSS PR:L, AV:L), and the attacker must win a race condition by replacing a specific file that the privileged Armoury Crate process consumes - i.e., timing-dependent 'crafted file replacement' during the TOCTOU window (reflected as AT:P, Attack Requirements Present). Limiting factors: no remote or unauthenticated path exists, no capability works without local code/file-write access, success is probabilistic because the race window must be hit, and only systems with Armoury Crate installed are exposed. No user interaction is needed (UI:N). |
| Impact | Signals are moderate and internally consistent: the CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N with VC:H/VI:H/VA:H) describes a local attacker who already has an account, no user interaction, but a Present attack requirement (AT:P) reflecting the timing/race window that must be won - this is what keeps the score at 7.3 rather than critical. No EPSS score was supplied and no KEV listing or POC is present, so there is no evidence of active or widespread exploitation; the realistic threat is a local attacker or malware escalating from a standard user to SYSTEM/admin on an ASUS machine, not remote mass exploitation. Note a limitation: EPSS is unavailable in the input, so exploitation probability cannot be quantified, and the reliability of winning the race in practice is unverified. This is a meaningful local-EoP priority for endpoints running Armoury Crate, but not an internet-facing emergency. |
| Exploit ScenarioDerived | An attacker with an ordinary local Windows account (or commodity malware running as a standard user) starts the vulnerable Armoury Crate privileged operation, then repeatedly replaces a file that the privileged service reads or executes, racing to swap in malicious content during the check-to-use window. On winning the race, the attacker's payload runs with the elevated privileges of the Armoury Crate service, granting full local compromise; no public exploit is identified at time of analysis, so this would require attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
Update Armoury Crate to the fixed build published by ASUS - consult the 'Security Update for ASUS Armoury Crate' section at https://www.asus.com/security-advisory for the exact patched version (Patch available per vendor advisory; a specific fix version was not included in the input and should not be assumed). Until the update is applied, reduce local attack surface by restricting interactive/standard-user access to affected machines, since exploitation requires a local account; where the software is not needed, uninstall or disable the Armoury Crate background services (trade-off: loss of RGB, fan, and update management). As a hardening measure, apply least-privilege and application-allowlisting so an unprivileged user cannot stage or execute the crafted replacement file, and monitor for unexpected writes to Armoury Crate service/updater working directories (trade-off: tuning required to avoid false positives from legitimate updates).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Armoury Crate is ASUS's unified Windows control-center application for managing RGB lighting, fan/performance profiles, driver and firmware updates, and Aura Sync on ROG/TUF laptops, desktops, and motherboards. It runs privileged background services and updater components, and CWE-362 (Concurrent Execution using a Shared Resource with Improper Synchronization) indicates a time-of-check-to-time-of-use (TOCTOU) defect: a privileged service validates or consumes a file whose path is writable or predictable by a lower-privileged user, allowing the file to be swapped between the check and the use. The 'crafted file replacement' vector in the description is the classic symptom of a privileged process operating on an attacker-influenceable filesystem location without an atomic, secure handle, so the attacker races to replace legitimate content with malicious content that the privileged process then acts upon.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local vector and existing low-priv account (AV:L/PR:L); the race window makes reliable exploitation timing-dependent (AC:H); privileged code execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (54bf65a7-a193-42d2-b1ba-8e150d3c35e1).
CVSS VectorVendor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
DescriptionCVE.org
Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Security Advisory for more information.
Executive ViewAI
ASUS Armoury Crate contains a local privilege escalation vulnerability affecting ASUS consumer and gaming hardware that could grant unauthorized administrative access to threat actors with low-level system access. Organizations deploying ASUS client hardware should prioritize identification of affected systems to prevent persistence mechanisms, lateral movement, and unauthorized access to corporate networks or data.
No vendor-released patch identified at time of analysis. Restrict local user privileges through least-privilege account segmentation and permission enforcement; disable or remove Armoury Crate if not operationally required; implement file-system and behavioral monitoring to detect race condition exploitation during application execution; enforce application control policies to constrain Armoury Crate execution and file-access scope; isolate affected systems in network zones with reduced lateral-movement risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB