ASUS Armoury Crate CVE-2026-75811

Exploitation requires a local, interactive session on a Windows system with ASUS Armoury Crate installed and its driver loaded - typically ASUS ROG, TUF, or ProArt hardware. The attacker must hold at minimum a standard (low-privileged) user account; unauthenticated or remote exploitation is not possible per the AV:L/PR:L CVSS vector. High attack complexity (AC:H) means the attacker must understand and replicate the driver's expected authentication protocol or find a bypass, which requires reverse engineering of the Armoury Crate driver. Exploitation is limited to Windows platforms where Armoury Crate is installed; the vulnerability does not affect Linux or macOS. The most limiting factors for realistic exploitation are physical or interactive local access and the technical sophistication required to craft valid driver requests.

The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) scores 5.8, reflecting local-only access (AV:L) with high attack complexity (AC:H) and low privilege (PR:L). Real-world risk is moderate: exploitation requires physical or interactive local access and the ability to craft inputs that defeat driver authentication, which implies non-trivial technical knowledge. However, the potential impact - hardware damage via register manipulation - is unusually severe for a 5.8 score, making this a higher-priority patch target on affected gaming hardware despite the modest score. There is no KEV listing and no known public exploit, which reduces urgency for most defenders. EPSS data is not provided. For gaming environments with shared machines (esports labs, shared family PCs, enterprise endpoints with ASUS hardware), the low-privilege requirement (any logged-in user) is a meaningful threat model. The 'Authentication Bypass' tag is defensible given driver-level auth circumvention, though the underlying issue is more precisely a hardware interface restriction failure.

A low-privileged local user on an ASUS ROG or TUF gaming laptop installs a crafted utility that sends specially formed IOCTL calls to the Armoury Crate driver, bypassing its authentication checks to gain direct write access to CPU model-specific registers. The attacker then sets CPU voltage offsets or power limits beyond safe thresholds, causing permanent CPU or VRM damage or forcing a system into an unstable thermal condition. No public exploit code is currently known, and the high attack complexity metric indicates this requires meaningful reverse-engineering of the driver interface.