ASUS GPU Tweak III EUVD-2026-55926

The attacker must have local access to the target system with high-privileged credentials (PR:H per CVSS 4.0), meaning a Windows administrator-level or equivalent account is required to open a handle to the affected kernel driver and issue the malicious IOCTL. At least one of the four affected ASUS software packages - GPU Tweak III, GPU Tweak II, AI Suite 3, or the VGAdll component - must be installed on the system, as the vulnerability lives in the kernel driver these utilities deploy. No network access, no user interaction, and no special non-default configuration beyond having the software installed are required. The key limiting factor is the PR:H requirement: standard unprivileged local users cannot reach the vulnerable IOCTL interface, substantially constraining the realistic attacker pool to those who already hold administrative access on the endpoint.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) assigns a score of 8.4. The PR:H metric is notable: it indicates the attacker must already possess high-privileged local access before exploiting the flaw, which significantly constrains the realistic attack surface. This creates a somewhat unusual framing - privilege escalation that itself requires high privileges - which may reflect escalation from Windows administrator to kernel/SYSTEM ring-0 level, a meaningful security boundary in Windows. EPSS data is not provided in the input, and the vulnerability is not present in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The combination of a well-understood exploitation class (arbitrary kernel write via IOCTL), low attack complexity (AC:L, AT:N), and full confidentiality/integrity/availability impact on the vulnerable system makes this a high-priority patch target for any system running the affected ASUS utilities. However, the PR:H prerequisite substantially limits exposure compared to a PR:L or PR:N variant.

A local attacker already operating with high-privileged Windows credentials (e.g., a standard administrator account or a compromised service account) opens a handle to the vulnerable ASUS kernel driver and issues a crafted IOCTL request containing an attacker-controlled pointer value. The driver, lacking bounds or validity checks on the supplied address, writes a specific value to the targeted kernel memory location, corrupting security-sensitive kernel data structures (such as token privileges or process protection flags) and elevating the attacker's effective privileges to SYSTEM or kernel level. No public exploit code has been confirmed, but the arbitrary-write primitive is a well-understood kernel exploitation building block.