ASUS GameSDK CVE-2026-8919

Requires the victim to be running the ASUS GameSDK local service and to actively visit an attacker-controlled or compromised web page (UI:P - user interaction is mandatory, so this cannot be triggered silently at scale without luring the target). The crafted page must be able to reach GameSDK's local service endpoint from the browser, which the permissive cross-domain policy allows from any untrusted origin, and the request must carry a UNC path so Windows performs outbound NTLM/SMB authentication. Exploitation is further limited by the victim's environment: outbound SMB (ports 445/139) to the attacker must be permitted, and NTLM authentication must be enabled - hosts that block outbound SMB or restrict outgoing NTLM largely neutralize the hash leak. No authentication is required of the attacker (PR:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L, score 7.2 High) reflects network reachability, low complexity, and no privileges, but exploitation hinges on user interaction (UI:P) - the victim must open a crafted page - which is the main limiting factor and typical of drive-by/phishing delivery. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is currently unquantified: treat this as a plausible but not confirmed-active threat. The most consequential impact is the availability rating (VA:H, GameSDK can be made unavailable) plus the credential-relay angle, which turns a 'low' confidentiality rating into a potential pivot into other NTLM-authenticated services. Overall this is a moderate-priority patch item: not a wormable unauthenticated RCE, but the combination of no-auth network reach, easy delivery, and NTLM relay potential makes it worth prioritizing on ASUS gaming endpoints, especially in domain environments where relayed hashes are valuable.

An attacker sends a phishing link or embeds a hidden request on a malicious/compromised web page. When an ASUS GameSDK user opens the page, their browser issues a cross-origin request to the local GameSDK endpoint carrying a UNC path pointing to the attacker's SMB server, causing Windows to transmit the user's NTLM hash. The attacker then cracks the hash offline or relays it to authenticate to other internal services; no public POC was provided but the technique (CORS-to-UNC NTLM leak) is well understood.