EUVD-2026-77367
GHSA-g9vq-5jvw-3c63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryOpen handle to Polychrome RGB kernel driver
-
ExploitCraft IOCTL with restricted I/O port target
-
ExecutionDriver writes to hardware I/O port without validation
-
ImpactForced OS reboot / availability loss
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires: (1) ASRock Polychrome SYNC/RGB software installed on the target Windows machine, with the kernel driver loaded and active - this is a consumer RGB utility not present in default OS installations; (2) any authenticated local user account (PR:L), no administrator or elevated privileges required; (3) physical or remote shell access to the target machine. What limits exploitation: strictly local attack vector with no network path; impact ceiling is DoS (forced reboot) with no code execution or data exfiltration capability; only affects systems where this specific ASRock RGB utility is intentionally installed, narrowing exposure to gaming/enthusiast hardware with ASRock motherboards or GPUs. |
| Impact | The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VA:H, scoring 6.8 Medium) is well-calibrated to the actual threat. Attack vector is strictly local - no network path exists - and the only confirmed impact is availability loss (forced reboot). No confidentiality or integrity impact is claimed in the CVSS, making the 'Information Disclosure' tag in the input metadata clearly wrong. EPSS data is absent; no KEV listing and no POC are referenced, suggesting this is a researcher-reported finding without active exploitation evidence. Real-world priority is moderate: the vulnerability is trivially exploitable by any local user on an affected system (AC:L, PR:L, no UI), but the impact ceiling is a reboot rather than code execution or data theft. Risk is elevated in multi-user environments, shared workstations, or systems where uptime is critical (e.g., content creation rigs, gaming cafes). Servers are unlikely to run this consumer RGB software, limiting enterprise exposure. |
| Exploit ScenarioDerived | A standard user logged into a Windows workstation with ASRock Polychrome SYNC/RGB installed opens a handle to the kernel driver's device object and sends a crafted IOCTL request specifying a hardware I/O port address in a restricted or system-reset-triggering range. The driver, without validating the target port, executes the write at kernel privilege level, causing the hardware to initiate an immediate system reset and forcing all running processes and unsaved work to be lost without a graceful shutdown. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
RemediationAI
Vendor-released patch status should be confirmed via the TWCERT advisory pages (https://www.twcert.org.tw/en/cp-139-11204-6b1c6-2.html), which are the authoritative source; no specific fixed version number is available in the current dataset. Until a patch is applied, the most effective compensating control is to uninstall or disable the ASRock Polychrome SYNC/RGB software and its associated kernel driver, which removes the vulnerable IOCTL attack surface entirely - trade-off being loss of RGB lighting control functionality. If removal is not feasible, restricting local user accounts to prevent access to driver device objects (using Windows DACL hardening on the device handle) can limit exposure to elevated accounts only, though this requires manual configuration. Organizations should audit which systems have this software installed and prioritize patching on any multi-user or high-availability endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected components are ASRock Polychrome SYNC/RGB software variants - one targeting motherboards (cpe:2.3:a:asrock:asrock_polychrome_sync/rgb_for_mb) and one for VGA/GPU cards (cpe:2.3:a:asrock:asrock_polychrome_sync/rgb_for_vga). Both install a Windows kernel driver that exposes an IOCTL interface to userspace applications for controlling RGB lighting hardware. CWE-1256 (Improper Restriction of Software Interfaces to Hardware Features) applies: the driver acts as a broker between software and hardware I/O ports but fails to enforce a whitelist or range-check on which I/O port addresses userspace IOCTL callers may instruct it to write. Writing to certain reserved or system-critical I/O ports (e.g., system reset ports) at the kernel level triggers immediate hardware responses - typically a forced system reboot - bypassing the OS shutdown sequence entirely.
Know when Asrock Polychrome Sync Rgb For Mb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local attack, low-privilege IOCTL caller, no confidentiality or integrity impact; scope unchanged as driver and OS are the same authorization domain.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
DescriptionCVE.org
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboot.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB