Aura Wallpaper Service CVE-2026-8920

Requires local access to a machine running the ASUS Aura Wallpaper Service with an existing low-privilege account (PR:L) and the ability to reach the service's local IPC/command channel - there is no remote vector (AV:L) and no user interaction (UI:N). The concrete trigger is sending a crafted command to the service that contains an arbitrary file path which bypasses the service's path restrictions; the exploit is limited by high attack complexity (AC:H), meaning the path-restriction bypass is not trivially reliable, and by the requirement that the Aura Wallpaper Service actually be installed and running. On only specific ASUS models does the additional feature-unavailability effect occur, so that secondary impact is model-dependent rather than universal.

The signals are moderately consistent and point to a real but locally-scoped privilege/manipulation issue rather than a mass-exploitable remote flaw. The CVSS 4.0 vector CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N shows a local attack vector requiring existing low privileges and high attack complexity (the attacker must win the path-restriction bypass), but no user interaction and high impact to confidentiality, integrity and availability, plus a confidentiality impact on a subsequent system component - hence the 8.5 High score. There is no EPSS value supplied, so exploitation probability cannot be quantified from this data. The vulnerability is not in CISA KEV (no confirmed active exploitation) and no POC is referenced, so it is 'no public exploit identified at time of analysis.' The Tags include 'Authentication Bypass,' which aligns with CWE-923's endpoint-restriction failure and is the practical mechanism (a caller who should not be trusted is served). Net: a genuine local privilege-abuse issue worth patching on ASUS endpoints, but not an internet-facing emergency; prioritize based on how many managed ASUS devices are in scope. Note the AC:H rating: the path-restriction bypass may be non-trivial, which lowers realistic exploitability somewhat.

A low-privileged user (or malware already running in that user's context) on an ASUS machine connects to the Aura Wallpaper Service's local command channel and issues a crafted command embedding an arbitrary file path that escapes the service's intended directory. The service, running with higher privilege, performs the requested file operation at the attacker-chosen location, letting the attacker read protected data or write/overwrite files to escalate privilege or corrupt state. No public POC is referenced, and the high attack complexity means the path-bypass step must be crafted successfully.