Exposed IOCTL in ASUS Armoury Crate Driver Allows Arbitrary PCI/PCIe Config Space Access
AI analysis
CVE-2026-16004 is an exposed IOCTL with insufficient access control (CWE-782) in the driver shipped with ASUS Armoury Crate, which fails to properly verify IOCTL requests from user space. A local user with low privileges can send crafted IOCTL requests that bypass the driver's verification checks and gain direct read and write access to arbitrary PCI/PCIe configuration space. An attacker could therefore tamper with hardware-level device configuration, producing high integrity and availability impact per the CVSS 4.0 score (5.9, Medium), though confidentiality impact is limited. Anyone running the vulnerable Armoury Crate driver component on a workstation or laptop is affected; exploitation requires local code execution, so remote attackers gain nothing without already having a foothold. As of now there is no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.1%.
What to do: Apply the Armoury Crate update described in the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory, which lists the fixed versions. Audit endpoints (especially gaming/workstation systems with ASUS boards) for the presence of the Armoury Crate driver and treat unpatched machines as allowing any local unprivileged process to alter PCI/PCIe configuration. Until patched, minimize untrusted local code execution on affected systems.
Affected
| ASUS Armoury Crate (driver component exposed via IOCTL) | — |
Estimated exposure
masspotentially millions of users (Armoury Crate is bundled with ASUS motherboards, laptops and other ROG/TUF hardware), though exploitation requires local access — Armoury Crate is preinstalled with ASUS's large installed base of ROG/TUF motherboards and gaming laptops, implying an order-of-magnitude exposure in the millions of systems, but the local-only attack vector and absence of public scans…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.