ASRock Polychrome SYNC CVE-2026-90890

Exploitation requires: (1) a Windows system with ASRock Polychrome SYNC/RGB for MB or VGA installed and its kernel-mode driver actively loaded; (2) a local authenticated user account with at least low-level privileges (PR:L - standard, non-administrator account is sufficient per the CVSS vector); (3) the ability to open a device handle to the ASRock RGB driver and submit IOCTL requests. Remote exploitation is not possible (AV:L - local vector only). The impact is limited entirely to an operating system crash (denial of service); no privilege escalation, code execution, or data access is described or implied by available data. Systems without the Polychrome SYNC/RGB software installed are not exposed.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.8 Medium) accurately characterizes the risk: exploitation is strictly local, requires only a standard user account (PR:L), and yields a system crash with no data exposure or integrity impact. There is no CISA KEV listing and no public POC, and EPSS data was not provided. The vulnerability cannot be triggered remotely and offers attackers no path to privilege escalation or information disclosure. Even a mid-sized municipal IT team in bytom managing a fleet of ASRock workstations with Polychrome SYNC installed should treat this as a medium-priority patch - realistic threat actors with existing local access and a goal of causing denial of service represent the primary risk profile, such as malicious insiders or post-compromise scenarios where system disruption is the objective. The absence of confidentiality and integrity impact materially limits its utility in most attack chains.

A standard local user account holder on a Windows workstation with ASRock Polychrome SYNC/RGB installed opens a handle to the product's kernel-mode driver device and submits a crafted IOCTL request embedding an unvalidated pointer value. The driver dereferences the attacker-controlled pointer in kernel context, triggering an access violation or null dereference exception that the kernel cannot recover from, resulting in an immediate BSOD and forced system reboot. No public POC has been identified, but the exploitation technique - sending malformed IOCTL payloads to kernel drivers - is well-documented and within reach of users familiar with Windows driver interfaces.