ASUS System Control Interface EUVD-2026-28486

Exploitation requires local access to the system with at least limited user privileges (PR:L per CVSS vector), sufficient to open handles to kernel drivers and issue IOCTL requests. The attacker must be able to interact with the ASUS System Control Interface driver, which is typically available to any authenticated local user on ASUS systems. No special system configuration, feature flag, or non-default setting is required - the vulnerable IOCTL handler exists in standard default configurations. The attack is limited by the local-only attack vector (AV:L) and authentication requirement (PR:L), preventing remote exploitation and restricting the threat to legitimate or compromised local accounts. Kernel driver restrictions or AppLocker policies that block execution of driver-interaction tools could serve as limiting factors, but standard IOCTL interaction is available to normal user processes.

CVSS 6.8 with CVSS:4.0/AV:L/AC:L/PR:L indicates local attack vector requiring low privilege user context with low complexity - a realistic threat from any unprivileged account on a compromised or shared system. The scoring emphasizes availability impact (VA:H) causing denial of service, with no confidentiality or integrity compromise. EPSS data is not provided, limiting prediction of exploitation prevalence. The absence of KEV status and public POC suggests this is not yet under active, widespread exploitation, but the straightforward nature of IOCTL fuzzing makes this a medium-priority issue for organizations with ASUS systems in multi-user or guest-access environments. The vulnerability requires local access and valid user credentials (PR:L), which significantly reduces risk compared to remote attacks, but still represents a viable avenue for local privilege escalation or denial of service by any logged-in user.

A local user with valid credentials logs into a shared ASUS system and runs a custom application or script that opens a handle to the ASUS System Control Interface driver and issues a specially crafted IOCTL request with a read size parameter larger than the kernel buffer. The IOCTL handler attempts to read data into the undersized buffer without bounds validation, causing a kernel-mode out-of-bounds read that triggers a page fault or access violation, crashing the kernel and displaying a Blue Screen of Death (BSOD).