Executive brief
A vulnerability in the ASUS Aura Wallpaper Service, a software component used to manage desktop aesthetics on ASUS devices, could allow a local user to perform unauthorized file operations. By sending specially crafted commands, an attacker could bypass security restrictions to access or modify files they should not have permission to reach. In some cases, this can also cause specific software features to become unavailable, potentially disrupting system customization and stability.
Technical details
The vulnerability stems from a combination of improper restriction of communication channels (CWE-923) and external control of file names or paths (CWE-73) within the Aura Wallpaper Service. A local attacker with low privileges can send crafted commands containing arbitrary file paths to the service, effectively bypassing intended path restrictions. This allows the attacker to perform file operations outside of the designated directories. On specific hardware models, exploitation can lead to a denial-of-service condition for specific software features. The vulnerability affects versions v2.1.8.0 through v2.1.15.0.
Affected products
- ASUS Aura Wallpaper Service v2.1.8.0 through v2.1.15.0
Timeline
- 2026-07-14: disclosed: Initial disclosure by ASUS via NVD and security advisory.
- 2026-07-15: advisory