EUVD-2026-55926
GHSA-cc5p-f4h4-cfmj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and PR:H follow ASUS's own assessment; S:C reflects the kernel driver writing to arbitrary OS memory, crossing the user-kernel trust boundary.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. Refer to the ' Security Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin ' section on the ASUS Security Advisory for more information.
AnalysisAI
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have local access to the target system with high-privileged credentials (PR:H per CVSS 4.0), meaning a Windows administrator-level or equivalent account is required to open a handle to the affected kernel driver and issue the malicious IOCTL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) assigns a score of 8.4. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker already operating with high-privileged Windows credentials (e.g., a standard administrator account or a compromised service account) opens a handle to the vulnerable ASUS kernel driver and issues a crafted IOCTL request containing an attacker-controlled pointer value. The driver, lacking bounds or validity checks on the supplied address, writes a specific value to the targeted kernel memory location, corrupting security-sensitive kernel data structures (such as token privileges or process protection flags) and elevating the attacker's effective privileges to SYSTEM or kernel level. … |
| Remediation | Apply the vendor-released patch as described in the ASUS Security Update Bulletin for GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate, available at https://www.asus.com/security-advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct asset inventory to identify all systems running ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, or associated kernel drivers; document business criticality of each installation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today