EUVD-2026-38205
GHSA-jjw4-7368-pw26
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only driver IOCTL reachable only from an administrator (AV:L, PR:H); crafted inputs must defeat validation (AC:H); arbitrary kernel R/W and BSOD yield full C/I/A impact.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
1DescriptionCVE.org
A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
AnalysisAI
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold.
Technical ContextAI
Armoury Crate is ASUS's bundled system-management and RGB/peripheral control suite for ROG/TUF hardware, which installs a privileged Windows service and a signed kernel-mode driver to expose low-level hardware features (MSR access, PCI config, physical memory) to the user-mode application. The weakness is classified as CWE-183 (Permissive List of Allowed Inputs): the validation layer that gates which IOCTLs, addresses, or operations user mode may request through the driver accepts a broader set of inputs than intended, so a local admin process can submit crafted requests that the driver treats as legitimate and uses to read or write arbitrary memory or dereference invalid pointers (producing a BSOD). Affected CPE is cpe:2.3:a:asus:armoury_crate, and ASUS documents the fix under the 'Security Update for Armoury Crate App' section of its security advisory portal.
RemediationAI
Patch available per vendor advisory: update Armoury Crate to the fixed release published under the 'Security Update for Armoury Crate App' section at https://www.asus.com/security-advisory (exact fix version not enumerated in the supplied data - confirm against the ASUS advisory before deployment). On systems that do not require Armoury Crate's RGB, fan-curve, or peripheral features, uninstalling Armoury Crate and removing its kernel driver entirely is the strongest mitigation and eliminates the attack surface, at the cost of losing hardware control features. Where uninstall is not acceptable, add the vulnerable Armoury Crate driver hash to the Microsoft Vulnerable Driver Blocklist / WDAC policy to prevent it from being loaded, accepting that this will break Armoury Crate functionality until the patched driver is installed; also restrict local administrator membership, since the bug is only reachable from an admin context.
More in Armoury Crate
View allASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which all
Local privilege escalation in ASUS Armoury Crate allows an authenticated low-privileged user to bypass driver validation
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a loca
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to by
Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system cr
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver auth
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass
Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode dr
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication a
NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-cont
The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, en
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today