ASUS Armoury Crate EUVD-2026-72619

Exploitation requires an interactive local user account on a Windows system with ASUS Armoury Crate and its kernel driver installed and running. The attacker must be able to open a handle to the driver's device object, which is accessible to non-administrative users due to the insufficient access control. No network access, no elevated privileges, and no user interaction from a victim are required. Exploitation is limited to: (1) physical or remote-desktop access to the local Windows session, (2) the Armoury Crate driver being loaded (typically at boot on ASUS OEM systems with the software installed), and (3) sufficient complexity (AC:H) to identify the correct IOCTL codes and craft valid PCIe register payloads without triggering a kernel bugcheck. Systems where Armoury Crate is not installed or the driver is disabled are not affected.

The vendor-provided CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) yields a score of 5.9 (Medium), which is a reasonable representation of the real-world risk. The local attack vector (AV:L) constrains exploitation to users who already have interactive access to the target machine, substantially limiting the exploitable population. AC:H reflects the complexity of locating the correct IOCTL code and crafting valid PCIe configuration space writes without crashing the system. PR:L confirms that a standard (non-admin) local user account is sufficient, meaning no privilege escalation prerequisite is needed. The integrity and availability impacts are rated High because arbitrary PCIe config-space writes can brick attached hardware or cause kernel panics. Confidentiality impact is Low - PCIe config registers are hardware-level metadata, not sensitive user data. No EPSS data was supplied, no KEV listing exists, and no public exploit code has been identified, all of which support treating this as a medium-priority local hardening issue rather than an urgent remote threat. The wildcard CPE version (*) indicates the affected version range has not been precisely bounded - defenders should consult the ASUS advisory for exact version scope.

A local user on a shared ASUS gaming PC - such as a secondary account on a family or shared workstation - opens a handle to the Armoury Crate kernel driver and sends a crafted IOCTL command that bypasses the driver's authentication check. The attacker iterates through PCIe device BARs using read IOCTLs to fingerprint installed hardware, then issues a write IOCTL targeting the PCIe Command Register bus-master enable bit of a discrete GPU or NIC, effectively disabling the device and causing a system-visible hardware fault or denial of service without requiring administrator rights.