Asrock Polychrome Sync Rgb For Mb
Monthly
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Authenticated local attackers on Windows systems running ASRock Polychrome SYNC/RGB can crash the operating system by submitting a specially crafted IOCTL request to the product's installed kernel-mode driver, which dereferences an attacker-supplied pointer without validation (CWE-822). Both the Motherboard (MB) and VGA variants of the software are affected, as confirmed by TWCERT. No public exploit code or active exploitation has been identified; impact is strictly denial of service with no confidentiality or integrity dimension, consistent with the CVSS 4.0 vector scoring VA:H with all other impact metrics at N.
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Authenticated local attackers on Windows systems running ASRock Polychrome SYNC/RGB can crash the operating system by submitting a specially crafted IOCTL request to the product's installed kernel-mode driver, which dereferences an attacker-supplied pointer without validation (CWE-822). Both the Motherboard (MB) and VGA variants of the software are affected, as confirmed by TWCERT. No public exploit code or active exploitation has been identified; impact is strictly denial of service with no confidentiality or integrity dimension, consistent with the CVSS 4.0 vector scoring VA:H with all other impact metrics at N.