ASUS PTP Filter CVE-2026-6737

Exploitation requires local user access to the target Windows system and sufficient privileges to send IOCTL requests to device driver interfaces (standard user privileges on Windows typically allow this). No special driver configuration or non-default setup is required - the vulnerability exists in the baseline driver code due to missing access control checks on exposed IOCTL handlers. The attacker must have a local user session on the machine; network-based exploitation is not possible. The touchpad driver must be installed and active, but this is the default state on ASUS devices with the PTP filter enabled.

Real-world risk is LOW to MODERATE for most environments. The CVSS score of 2.0 is intentionally low because scope is unchanged (attacker gains access to touchpad data/state only, not the broader system) and severity is low across all impact categories. However, the CVSS vector shows AV:L (local attack vector) and PR:L (requires low-level privileges), meaning an attacker must already have local system access. This is a privilege escalation or lateral movement risk within multi-user systems, not a remote entry point. The 'Authentication Bypass' tag suggests that a local user can circumvent driver-level authentication checks, but this does not equate to privilege elevation to administrator. EPSS data is not provided, and KEV status is unknown, so widespread active exploitation is not confirmed. The threat is primarily relevant to shared workstations, corporate environments with untrusted local users, or scenarios where the touchpad itself is a target (e.g., disabling it as a denial-of-service attack). Patch availability is not explicitly confirmed beyond the vendor advisory reference.

An unprivileged local user on a shared Windows workstation crafts and sends malicious IOCTL requests directly to the AsusPTPFilter driver device interface. Without proper access validation, the driver processes the requests and either leaks touchpad configuration or sensitivity data to the user's process, or disables the touchpad, causing a denial of service to other users on the system. This attack requires the attacker to already have a user account on the machine; remote attackers cannot exploit this directly.