Quick answers
- Is CVE-2026-8917 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8917 being exploited in the wild.
- How severe is CVE-2026-8917?
- Informational severity, published 11 August 2026.
- Which products and versions are affected?
- ASUS AI Suite 3 <UNKNOWN>; ASUS GPU Tweak II <UNKNOWN>; ASUS GPU Tweak III <UNKNOWN>; ASUS VGAdll <UNKNOWN>.
- Is there a fix for CVE-2026-8917?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8917 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-8917?
- Check whether you run ASUS AI Suite 3, ASUS GPU Tweak II, ASUS GPU Tweak III or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An untrusted pointer dereference vulnerability exists in the IOCTL handlers of ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll. The vulnerability allows a local, authenticated attacker to supply a malicious pointer via IOCTL, which the driver dereferences without validation, enabling arbitrary memory writes. This can be exploited to overwrite critical kernel structures, bypass security mechanisms, or achieve privilege escalation from user-mode to kernel-mode execution. The attack requires local access but does not require elevated privileges as a precondition. Patches and security updates are available from ASUS.
Affected products
- ASUS GPU Tweak III <UNKNOWN>
- ASUS GPU Tweak II <UNKNOWN>
- ASUS AI Suite 3 <UNKNOWN>
- ASUS VGAdll <UNKNOWN>
Timeline
- 2026-08-11: disclosed