ASUS Armoury Crate CVE-2026-18023

Requires an interactive or remote-shell local user session on a Windows host with the ASUS Armoury Crate application and its kernel driver actively installed and running. The attacker does not need administrator privileges (PR:L), but must be able to open a handle to the driver device object, which is typically accessible to standard users. The critical limiting factor is AC:H - the attacker must construct an IOCTL payload that specifically circumvents the driver's security verification mechanism, implying knowledge of the driver's IOCTL interface through reverse engineering or prior research. Impact is strictly read-only (VC:H, VI:N, VA:N); no code execution or system modification results from this CVE alone. Deployment is limited to systems with ASUS Armoury Crate installed, primarily ASUS ROG/TUF/ProArt gaming and creator hardware running Windows.

The CVSS 4.0 score of 5.7 with AV:L/AC:H/PR:L/UI:N/VC:H/VI:N/VA:N accurately reflects the realistic threat profile. Local access is mandatory - network-remote exploitation is not possible. The AC:H metric captures the real barrier: the attacker must reverse-engineer or otherwise defeat the driver's IOCTL security verification mechanism, which is a non-trivial task requiring driver analysis skills and custom tooling. The impact ceiling is VC:H (high confidentiality breach at the vulnerable-system level) with no integrity or availability dimension, meaning this cannot directly escalate to code execution per available data. The vulnerability is not in CISA KEV, no POC is referenced, and EPSS was not provided - all signals point to no widespread exploitation. Real-world priority is moderate: meaningful on shared workstations, gaming café environments, or as an information-gathering step in a multi-stage local privilege escalation chain, but low urgency for single-user ASUS gaming PCs where the local user is already the owner. The wildcard CPE version range means all installed Armoury Crate versions should be treated as affected until ASUS publishes a specific patched build.

A local user account on a Windows machine with ASUS Armoury Crate installed opens a handle to the driver device object and sends a crafted IOCTL request structured to pass through or bypass the driver's security verification gate. The driver allocates an output buffer without initializing it and copies stale kernel pool data back to the caller, potentially exposing sensitive artifacts - such as password hashes, decrypted secrets, or kernel pointers - that happened to reside in that memory region. No public exploit code is known to exist at time of analysis.