ASUS Armoury Crate EUVD-2026-72618

Exploitation requires local, interactive or terminal-level access to the target system with at least a low-privilege OS user account (PR:L from the CVSS 4.0 vector). The attacker must successfully bypass the Armoury Crate driver's authentication mechanism (AC:H), which is not a trivial step and limits opportunistic exploitation. The Armoury Crate application and its kernel driver must be installed and running on the host; systems without Armoury Crate are entirely unaffected. The attack produces only a DoS via repeated SMI triggering - no confidentiality or integrity compromise is achievable. Remote exploitation over a network is not possible (AV:L). The condition is limited to: local access + low OS privileges + Armoury Crate driver active + ability to bypass driver auth.

The CVSS 4.0 score of 5.7 (AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects a medium-severity, local-only issue. The high attack complexity (AC:H) is justified by the requirement to bypass driver authentication, which limits opportunistic exploitation and raises the skill bar above trivial IOCTL abuse. Impact is strictly limited to availability - there is no confidentiality or integrity exposure - making this a DoS-class flaw rather than a privilege escalation or data theft risk. No public exploit code has been identified at time of analysis, and it is absent from CISA KEV, confirming no confirmed active exploitation. Even a mid-sized municipal IT team in rybnik should treat this as a low-urgency patch applicable at the next scheduled maintenance window rather than an emergency response, given the local-only attack surface and the absence of post-exploitation primitives. The primary realistic concern is in shared-access or kiosk-style environments running ASUS gaming hardware where an unprivileged local account is accessible to untrusted users.

A local unprivileged user on an ASUS gaming PC with Armoury Crate installed crafts direct IOCTL calls to the Armoury Crate kernel driver, exploiting the missing authentication check to invoke the SMI-triggering function. By issuing rapid successive requests, the attacker forces the CPU into System Management Mode repeatedly, causing sustained system stalls that effectively deny service to all other processes on the machine. No public exploit code is known at this time, and the high attack complexity requirement means this is not a trivial point-and-click exploit.