ASUS Armoury Crate CVE-2026-8918

Requires local code execution as an administrator on a Windows endpoint with ASUS Armoury Crate 6.4.12 or earlier installed and its kernel driver loaded - the attacker must be able to open a handle to the Armoury Crate driver and issue IOCTLs through it, which Windows restricts to administrative contexts. Exploitation is further gated by the high attack complexity noted in the CVSS 4.0 vector (AC:H), implying the attacker must craft inputs that satisfy the driver's permissive but non-trivial validation logic. Limiting factors: no remote vector (AV:L), no exploitation from standard user accounts, and ineffective on systems where Armoury Crate is not installed or where the vulnerable driver is blocked by WDAC / Microsoft's vulnerable driver blocklist.

Real-world risk is moderate and tightly bounded by the prerequisites. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) confirms the attacker must already be a local administrator and that exploitation is non-trivial, which significantly limits opportunistic abuse. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score is provided in the input, so widespread exploitation is unlikely. However, the impact is meaningful in the context of LOLDriver / BYOVD tradecraft: a signed, widely-installed ASUS driver that grants arbitrary kernel read/write is exactly the primitive malware authors use to disable EDR, dump LSASS, or escalate from admin to SYSTEM/kernel, so on endpoints where the vulnerable version remains installed this can become a post-compromise force multiplier rather than an initial-access bug.

An attacker who has already obtained local administrator privileges on an ASUS endpoint (for example, via phishing followed by a UAC bypass) loads the legitimate Armoury Crate driver and sends crafted IOCTLs that pass the driver's permissive validation, granting arbitrary kernel read/write. They then use that primitive to patch out EDR callbacks or zero token privileges to escalate from admin to SYSTEM/kernel and establish stealthy persistence. No public exploit identified at time of analysis, but the pattern is well-established for similar vendor drivers.