CVE-2026-16003

ASUS Armoury Crate's bundled driver exposes an IOCTL interface with insufficient access control (CWE-782), letting a local user bypass the driver's verification and add an arbitrary process identifier to the driver's whitelist. An attacker with low privileges on the machine can trigger this by sending a crafted IOCTL request, gaining limited integrity impact by getting a process of their choice treated as trusted by the driver. The flaw is rated Low (CVSS 4.0 score 2.0) because it requires local access, involves high attack complexity, and has a low-only integrity impact, and it affects systems running the Armoury Crate driver that ASUS bundles with its motherboards and gaming products. No public proofs of concept are known, the issue is not on the CISA KEV list, and EPSS currently estimates only a 0.1% probability of exploitation in the next 30 days. ASUS has addressed it via the 'Security Update for Armoury Crate App' section of its security advisory, though specific affected or fixed version numbers were not provided in the available data.

What to do: Update Armoury Crate using the app's built-in updater or the package referenced in the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory, and check your installed version against that advisory since no version numbers are given here. Because exploitation requires local low-privileged code execution, avoid running untrusted local processes on affected systems until patched. No workaround is documented in the available data.