CVE-2026-102438

published 2026-10-20

CVE-2026-102438: An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of…

Priority P3 43 high 8.5 CVSS 4.0

AV L AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
asus	armoury_crate	V3.0.0. – V6.5.10	—
asus	armoury_crate_se	V2.1.17 – V2.2.17	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-427