Armoury Crate EUVD-2026-72622

Exploitation requires a local user account on the target Windows system (PR:L - low-privileged account sufficient). The Armoury Crate application and its kernel driver must be installed and the driver service must be running (default state after installation on ASUS gaming hardware). The attack requires crafting a specific IOCTL payload that bypasses the driver's pointer-verification routine (AC:H - non-trivial reverse engineering of the driver's validation logic is necessary). No network access, no user interaction from a victim, and no elevated (admin) privileges are required. Exploitation is bounded to the local machine; remote exploitation is not possible given AV:L.

Real-world risk is moderate-to-low relative to the overall severity class. The CVSS 4.0 vector (AV:L/AC:H/PR:L) confirms that exploitation is local-only and requires elevated complexity to bypass the driver's validation, limiting remote or opportunistic abuse. EPSS data is not provided; given the local vector and required bypass complexity, broad automated exploitation is unlikely. No CISA KEV listing and no public POC have been identified. The primary impact is availability (BSOD/crash) and integrity (heap/data-structure corruption); confidentiality is unaffected (VC:N). In a shared or multi-tenant Windows gaming environment (e.g., internet café, lab), a low-privileged local user could use this to crash the system at will, constituting a reliable local DoS. A more advanced attacker could potentially leverage the heap corruption for privilege escalation, but that capability is not confirmed by the description. The availability and integrity signals (VA:H/VI:H) are consistent with the BSOD and data-structure-corruption impact described.

A low-privileged local user on a Windows gaming PC with Armoury Crate installed crafts a malicious IOCTL request that contains a pointer value constructed to pass the driver's validation check but reference an invalid or already-freed kernel memory address. When the driver processes the request and calls the memory-free routine on the attacker-controlled address, it corrupts the kernel heap, triggering an immediate BSOD. No public exploit code has been identified; the AC:H rating indicates the bypass is non-trivial to develop.