Executive brief
The ASUS Armoury Crate driver, used to manage system settings and RGB lighting on ASUS hardware, contains an exposed IOCTL interface with insufficient access control. A local attacker can exploit this flaw to add arbitrary process identifiers to the driver's whitelist, potentially bypassing security restrictions and gaining elevated privileges without authorization.
Technical details
The vulnerability exists in the Armoury Crate driver's IOCTL (I/O Control) handler, which lacks proper access validation on requests to modify the process whitelist. An attacker with local system access can craft a malicious IOCTL request to add an arbitrary process identifier to the driver's whitelist, circumventing the driver's verification mechanisms. This is a local privilege escalation vector requiring existing access to the affected system. The attack does not require network connectivity or user interaction beyond executing the malicious IOCTL request. Patch details are referenced in the ASUS Security Advisory; users should apply the recommended security update to Armoury Crate.
Affected products
- ASUS Armoury Crate <UNKNOWN>
Timeline
- 2026-09-08: disclosed