ASUS Motherboards EUVD-2026-110597

Exploitation requires the attacker to already possess kernel-level (ring-0) privileges on the local host (consistent with CVSS PR:H and AV:L) - this is the primary limiting factor and means the flaw is not remotely or unauthenticated-reachable. The concrete trigger is supplying an arbitrary memory address through an I/O command to the affected ASUS motherboard firmware, which then dereferences the untrusted pointer. Impact is limited to integrity (tampering with system information) and availability (system crash); there is no confidentiality exposure and no cross-component scope change. Affected firmware spans specific ASUS series (e.g., TRX50, X870E, X870, B650, B850, B840, W790, WRX90, X670, X570, A520/B550, A620/A620A, Knoll); updating to the vendor-listed fixed firmware for each series (e.g., X570 Series 5054, W790 Series 2101, WRX90 Series 1403) remediates it.

This is a genuinely moderate, not critical, issue and the signals are consistent with that reading. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, score 6.8) describes a local attack that requires high privileges - the description specifies a 'kernel-level privileges user,' meaning the attacker must already hold ring-0/kernel access before this flaw adds anything. Impact is confined to integrity and availability (VI:H/VA:H: tampering with system information or crashing the system) with no confidentiality impact (VC:N) and no scope change (SC:N/SI:N/SA:N). The EPSS score of 0.11% (1st percentile) is very low, there is no CISA KEV listing (not actively exploited), and no public exploit code was identified in the provided references. The vuln.today decision label is 'this_month,' indicating routine scheduled patching rather than emergency action. The signals do not conflict: a low-EPSS, non-KEV, high-privilege-required local flaw correctly reads as low real-world urgency. The main caveat is that because the attacker already needs kernel-level privileges, the practical security value of this vulnerability is limited - it mostly offers a path to tamper with firmware/system data or cause denial of service from an already-privileged position.

An attacker who has already achieved kernel-level (ring-0) code execution on a machine running affected ASUS motherboard firmware issues a crafted I/O command supplying an arbitrary memory address. The firmware dereferences that untrusted pointer, letting the attacker corrupt system information or crash the host. No public exploit code was identified at time of analysis, and because kernel privileges are a prerequisite, this serves as a post-exploitation primitive rather than an initial-access vector.