ASUS Armoury Crate EUVD-2026-104782

Requires the attacker to already have local code-execution ability as a low-privileged user (PR:L) on a system running ASUS Armoury Crate, plus write access to a directory that appears earlier in the DLL search order than the legitimate library loaded by the high-privilege Armoury Crate component. Exploitation is limited by these prerequisites: it is local only (AV:L), cannot be performed remotely or unauthenticated, and depends on the vulnerable high-privilege process actually loading the hijacked DLL (typically at service/process start). No user interaction by a victim is needed (UI:N). Non-ASUS systems and machines without Armoury Crate installed are unaffected.

This is a credible but not emergency-tier priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.5) is internally consistent with the description: a local, low-privilege user (PR:L) with no user interaction exploits DLL search-order hijacking (CWE-427) to gain full confidentiality/integrity/availability impact - i.e. SYSTEM-level code execution. The high score is driven by the complete impact (local privilege escalation to SYSTEM), not by remote reach - AV:L means the attacker must already have a foothold on the machine. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The 'RCE' tag overstates the vector: this is local privilege escalation / local code execution, not remote code execution, since the CVSS vector is explicitly AV:L. Net assessment: a real, patch-worthy local privilege-escalation flaw on ASUS consumer hardware, but it requires pre-existing local access and is not a mass-exploitable internet-facing issue; prioritize patching on shared or multi-user ASUS systems over isolated single-user machines.

An attacker who already has a standard (non-administrator) local account on an ASUS Windows machine plants a malicious DLL in a directory searched before the legitimate one by an Armoury Crate high-privilege process. When that SYSTEM-level process starts or reloads, it loads the attacker's DLL instead, executing arbitrary code as SYSTEM and escalating from low privileges to full system control. No public exploit code is referenced, but DLL-hijacking primitives of this class are well understood and straightforward to weaponize.