Is CVE-2022-4990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-4990 being exploited in the wild.

How severe is CVE-2022-4990?

Informational severity, with a CVSS score of 7.3, published 3 July 2026.

Which products and versions are affected?

ASUS AI Suite 3 before v3.03.00.

Is there a fix for CVE-2022-4990?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-4990 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2022-4990?

Check whether you run ASUS AI Suite 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-4990: ASUS AI Suite 3 privilege escalation in driver

CVE-2022-4990 · Severity: info · CVSS 7.3 · Published 2026-07-03

ASUS AI Suite 3 is a performance tuning and system monitoring utility for ASUS motherboards. A security flaw in its system driver allows a local user with low privileges to access restricted memory areas. This could allow an attacker to gain full administrative control over the computer, potentially leading to data theft or persistent system compromise.

Technologies: ASUS AI Suite 3. Vendors: ASUS.

Quick answers

Is CVE-2022-4990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-4990 being exploited in the wild.
How severe is CVE-2022-4990?: Informational severity, with a CVSS score of 7.3, published 3 July 2026.
Which products and versions are affected?: ASUS AI Suite 3 before v3.03.00.
Is there a fix for CVE-2022-4990?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-4990 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2022-4990?: Check whether you run ASUS AI Suite 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ASUS AI Suite 3 driver due to improper validation of specified quantities in input (CWE-1284). A local attacker with low privileges can issue specially crafted I/O Control (IOCTL) requests to the driver to bypass security validations. This allows the attacker to access restricted memory blocks, which can be leveraged to achieve kernel-level privilege escalation. The issue is addressed in versions v3.03.00 and later.

Affected products

ASUS AI Suite 3 before v3.03.00

Timeline

2026-07-03: advisory: NVD publication date
2026-07-02: disclosed: ASUS reported the vulnerability to CVE list

References

https://www.asus.com/security-advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.