Asus and Adobe vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-1533 | A stack buffer overflow has been identified in the AsIO3.sys driver. A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. NVD description · AI analysis pending | 8.2 | <1% | — | — | ||
| CVE-2025-3464 | A race condition vulnerability exists in Armoury Crate. A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. NVD description · AI analysis pending | 8.4 | <1% | — | — | ||
| CVE-2025-43576 +1 in the same advisory: …43578 | Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. NVD description · AI analysis pending | 7.8 group max | <1% |
| — |
Full article348 words · extracted from blog.talosintelligence.com · click to collapse
Thursday, July 10, 2025 11:24
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed two vulnerabilities each in Asus Armoury Crate and Adobe Acrobat products.
The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.
Asus Armoury Crate stack-based buffer overflow and authorization bypass vulnerabilities
Discovered by Marcin "Icewall" Noga of Cisco Talos.
These vulnerabilities were recently covered in a deep-dive post, Decrement by one to rule them all.
Asus Armoury Crate is a software utility used to manage Asus and ROG lighting, performance, and updates.
TALOS-2025-2144 (CVE-2025-1533) is a stack-based buffer overflow vulnerability in the AsIO3.sys kernel driver of Asus Armoury Crate 5.9.13.0. A specially crafted I/O request packet (IRP) can lead to stack-based buffer overflow. An unprivileged attacker can run a program from user mode to trigger this vulnerability.
TALOS-2025-2150 (CVE-2025-3464) is an authorization bypass vulnerability in the AsIO3.sys functionality of Asus Armoury Crate 5.9.13.0. A specially crafted hard link can lead to an authorization bypass. An attacker can create a hard link to trigger this vulnerability.
Adobe Acrobat Reader out-of-bounds read and use-after-free vulnerabilities
Discovered by KPC of Cisco Talos.
Adobe Acrobat Reader is one of the most popular PDF reading software currently available. Talos found an out-of-bounds read vuln, TALOS-2025-2159 (CVE-2025-43578), in the Font functionality of Adobe Acrobat Reader 2025.001.20435. A specially crafted font file embedded into a PDF can trigger this vulnerability which can lead to disclosure of sensitive information.
TALOS-2025-2170 (CVE-2025-43576) is a use-after-free vulnerability in the annotation object processing functionality of Adobe Acrobat Reader 2025.001.20435. A specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and could result in arbitrary code execution.
An attacker needs to trick the user into opening the malicious file to trigger either of these vulnerabilities.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/asus-and-adobe-vulnerabilities/