Executive brief
ASUS Precision Touchpad driver for Windows contains an exposed system driver interface (IOCTL) that lacks proper permission checks. A local attacker with standard user privileges can send crafted commands to the driver to bypass security controls, potentially stealing touchpad configuration data or disabling the touchpad entirely.
Technical details
The vulnerability is an exposed IOCTL (I/O Control) interface in the AsusPTPFilter driver with insufficient access control validation. The root cause is improper security descriptor or privilege level checking on the IOCTL handler, allowing any local user to trigger privileged driver operations without proper authorization. The attack vector is local; an attacker must execute code on the target system but requires no special privileges. An attacker can craft malicious IOCTL requests to bypass driver security mechanisms, retrieve restricted touchpad information, or render the touchpad non-functional. A security update addressing this vulnerability has been released by ASUS.
Affected products
- ASUS Precision Touchpad <UNKNOWN>
Timeline
- 2026-05-08: disclosed