CVE-2026-18023

CVE-2026-18023 is an information disclosure flaw (CWE-226, Sensitive Information in Resource Not Removed Before Reuse) in the driver component of ASUS Armoury Crate, ASUS's tuning and control software bundled with its ROG/TUF gaming motherboards, laptops, and desktops. A local user with low privileges can send a specially crafted IOCTL request that bypasses the driver's security verification mechanism, causing the driver to return memory that has not been cleared of previously stored data. The attacker gains disclosure of sensitive information left in uninitialized memory, with high confidentiality impact but no integrity or availability impact per the CVSS 4.0 score of 5.7 (medium). Affected users are those running the Armoury Crate driver on ASUS systems; the vendor has published a fix in the 'Security Update for Armoury Crate App' section of its security advisory. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Check which version of Armoury Crate and its driver is installed on affected ASUS systems and apply the update referenced in the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory, using the built-in Armoury Crate updater or the ASUS support download page. Because exploitation requires local access, prioritize shared or multi-user Windows machines; the ASUS advisory lists the specific fixed versions.