ASUS Armoury Crate EUVD-2026-33244

Exploitation requires the attacker to already have local, authenticated code execution on a Windows host with ASUS Armoury Crate installed and its kernel driver loaded (PR:L, AV:L); no user interaction is needed (UI:N). The driver's device interface must be reachable from the attacker's session, and the CVSS AC:H rating indicates that triggering the bypass reliably depends on specific timing or input shaping against the driver's flawed permission/validation logic rather than a one-shot primitive. Limiting factors: this is not remotely exploitable, cannot be reached without Armoury Crate being installed and running, and is confined to the local machine (SC:N/SI:N/SA:N - no scope change to other components).

CVSS 4.0 vector AV:L/AC:H/PR:L/UI:N with VC:H/VI:H/VA:H yields 7.3 (High), reflecting local access, low privileges, and high attack complexity offset by full CIA impact on the vulnerable system. SSVC-style signals point to a meaningful but not urgent threat: technical impact is total (arbitrary physical memory read/write is effectively a kernel compromise primitive), but exploitation requires existing code execution on the host and the AC:H rating suggests reliable triggering needs specific conditions. No EPSS score, KEV listing, or public POC was provided, so this is best treated as a high-impact LPE that is attractive to post-compromise toolchains (EDR bypass, credential theft via LSASS memory reads) rather than a mass-exploitation risk. The Authentication Bypass tag refers to bypassing the driver's internal validation, not Windows authentication - defenders should not over-weight it as a network-reachable auth flaw.

An attacker who has obtained low-privileged code execution on an ASUS endpoint - for example via a phishing payload landing in a standard user context - opens a handle to the Armoury Crate driver device and issues crafted IOCTLs that bypass its validation to map and write arbitrary physical memory. Using that primitive, they patch kernel structures to elevate their token to SYSTEM, disable EDR callbacks, or read LSASS memory for credential harvesting, pivoting from a routine user-level foothold to full host compromise.