# CVE-2026-15029: ASUS System Control Interface Untrusted Pointer Dereference

Source: https://junglewise.ai/threats/cve-2026-15029-asus-system-control-interface-untrusted-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-15029 · Severity: info · CVSS 8.4 · Published 2026-07-15

A vulnerability in ASUS system management software could allow a user with administrative privileges to bypass standard operating system security protections. By interacting with a specific software driver, an attacker could gain unauthorized access to the computer's physical memory. This could lead to the theft of sensitive data or the ability to modify critical system operations, potentially compromising the entire device.

## Quick answers

**Is CVE-2026-15029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15029 being exploited in the wild.

**How severe is CVE-2026-15029?** Informational severity, with a CVSS score of 8.4, published 15 July 2026.

**Which products and versions are affected?** ASUS System Control Interface v3 less than v3.1.65.0; ASUS System Control Interface less than v1.1.40.0; ASUS Business Manager less than or equal to v3.0.38.0.

**Is there a fix for CVE-2026-15029?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15029 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-15029?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An untrusted pointer dereference vulnerability (CWE-822) exists in the drivers for ASUS System Control Interface (v1 and v3) and ASUS Business Manager. A local attacker with administrative privileges can send specially crafted Input/Output Control (IOCTL) requests to the affected driver. This allows the attacker to bypass OS-enforced memory protections and perform arbitrary read and write operations directly to physical memory. Such access can be used to escalate privileges further or compromise the kernel. ASUS has released updates to address this issue in System Control Interface v3.1.65.0, v1.1.40.0, and Business Manager versions following v3.0.38.0.

## Affected products

- ASUS System Control Interface v3 less than v3.1.65.0
- ASUS System Control Interface less than v1.1.40.0
- ASUS Business Manager less than or equal to v3.0.38.0

## Timeline

- 2026-07-15: disclosed: CVE published by ASUS/NVD

## References

- [https://www.asus.com/security-advisory](https://www.asus.com/security-advisory)