Asus Armoury Crate vulnerabilities

CVE-2023-5716 [CRITICAL] CWE-306 CVE-2023-5716: ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission.

CVE-2025-3464 [HIGH] CWE-367 CVE-2025-3464: A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-che A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2026-102438 [HIGH] CWE-427 CVE-2026-102438: An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execut An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information

CVE-2024-12957 [HIGH] CWE-306 CVE-2024-12957: A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary f A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2025-9968 [HIGH] CWE-59 CVE-2025-9968: A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerabi A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section 'Security Update for Armoury Crate App' in the ASUS Security Advisory.

CVE-2025-1533 [HIGH] CWE-121 CVE-2025-1533: A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be trigg A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2022-42455 [HIGH] CWE-269 CVE-2022-42455: ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges.

CVE-2026-16727 [HIGH] CWE-362 CVE-2026-16727: Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Security Advisory for more information.

CVE-2025-9338 [HIGH] CWE-119 CVE-2025-9338: A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing a specially crafted process, potentially leading to local privilage escalation. For additional information, please refer to the 'Security Update for Armoury Crate App' section of the ASUS Securit

CVE-2026-8070 [HIGH] CWE-732 CVE-2026-8070: Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypa Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CVE-2023-26911 [HIGH] CWE-428 CVE-2023-26911: ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vul ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.

CVE-2026-16004 [MEDIUM] CWE-782 CVE-2026-16004: Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read a Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2025-9336 [MEDIUM] CWE-121 CVE-2025-9336: A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be trigg A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2026-75809 [MEDIUM] CWE-782 CVE-2026-75809: Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosu Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for m

CVE-2026-8918 [HIGH] CWE-183 CVE-2026-8918: A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform ar A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CVE-2026-75811 [MEDIUM] CWE-1256 CVE-2026-75811: Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a loca Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing critical model-specific registers.Refer to the ' Security Update for Armoury Crate App' section on the ASUS Securi

CVE-2026-16005 [MEDIUM] CWE-763 CVE-2026-16005: Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrar Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more inform

CVE-2026-12962 [MEDIUM] CWE-942 CVE-2026-12962: A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote us A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS

CVE-2025-9337 [MEDIUM] CWE-476 CVE-2025-9337: A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be tri A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD). Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

CVE-2026-75808 [MEDIUM] CWE-770 CVE-2026-75808: Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to ca Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount of memory.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more