# CVE-2026-15030: ASUS System Control Interface out-of-bounds read via IOCTL

Source: https://junglewise.ai/threats/cve-2026-15030-asus-system-control-interface-out-of-bounds-read-via-ioctl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-15030 · Severity: info · CVSS 5.6 · Published 2026-07-15

ASUS System Control Interface and Business Manager are software components used to manage hardware settings and system optimization on ASUS computers. A security vulnerability in these tools could allow a local user with administrative privileges to read sensitive system memory that should normally be protected. This could lead to the exposure of confidential information stored in the computer's firmware or system memory.

Technologies: [ASUS Business Manager](https://junglewise.ai/threats/technologies/business-manager), [ASUS System Control Interface](https://junglewise.ai/threats/technologies/system-control-interface), [ASUS System Control Interface v3](https://junglewise.ai/threats/technologies/system-control-interface-v3). Vendors: [ASUS](https://junglewise.ai/threats/vendors/asus).

## Quick answers

**Is CVE-2026-15030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15030 being exploited in the wild.

**How severe is CVE-2026-15030?** Informational severity, with a CVSS score of 5.6, published 15 July 2026.

**Which products and versions are affected?** ASUS Business Manager up to and including v3.0.38.0; ASUS System Control Interface before v3.1.65.0; ASUS System Control Interface v3 before v3.1.65.0.

**Is there a fix for CVE-2026-15030?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15030 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-15030?** Check whether you run ASUS Business Manager, ASUS System Control Interface or ASUS System Control Interface v3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in ASUS System Control Interface (v1 and v3) and ASUS Business Manager. The flaw is located in the handling of Input/Output Control (IOCTL) requests, where the software fails to properly validate the boundaries of memory access requests. A local attacker with high privileges (administrator) can exploit this by sending a specially crafted IOCTL request to bypass validation and read memory regions beyond the intended firmware boundary. This could result in the disclosure of sensitive information from system memory. ASUS has released updates to address this issue in System Control Interface v3.1.65.0 and v1.1.40.0.

## Affected products

- ASUS System Control Interface v3 before v3.1.65.0
- ASUS System Control Interface before v1.1.40.0
- ASUS Business Manager up to and including v3.0.38.0

## Timeline

- 2026-07-15: advisory: NVD publication date

## References

- [https://www.asus.com/security-advisory](https://www.asus.com/security-advisory)

## Related threats

- [ASUS System Control Interface IOCTL insufficient access control](https://junglewise.ai/threats/cve-2026-112116-an-exposed-ioctl-with-insufficient-access-control-in-asus-system)
- [ASUS System Control Interface and Business Manager Information Disclosure and DoS](https://junglewise.ai/threats/cve-2026-13585-asus-system-control-interface-and-business-manager-information)
- [ASUS Business Manager privilege escalation via tampered IPC message](https://junglewise.ai/threats/cve-2026-8921-asus-business-manager-privilege-escalation-via-tampered-ipc)
- [ASUS System Control Interface privilege escalation via crafted RPC call](https://junglewise.ai/threats/cve-2026-7480-asus-system-control-interface-privilege-escalation-via-crafted-rpc)