CVE-2026-16004: Armoury Crate Driver Privilege Escalation

CVE-2026-16004 Overview

CVE-2026-16004 is a driver vulnerability in the ASUS Armoury Crate application. The flaw stems from an exposed I/O control (IOCTL) interface with insufficient access control [CWE-782]. A local authenticated user can bypass the driver's verification checks and issue crafted IOCTL requests. These requests allow arbitrary read and write access to PCI/PCIe configuration space. The vulnerability affects Windows systems running vulnerable versions of the Armoury Crate driver. ASUS has published remediation guidance in the Security Update for Armoury Crate App section of its security advisory.

Critical Impact
Local users can read and write arbitrary PCI/PCIe configuration space, enabling hardware manipulation, integrity compromise, and potential denial of service on affected systems.

Affected Products

ASUS Armoury Crate application driver on Windows
Refer to the ASUS Security Advisory for the specific affected driver versions
Systems with the vulnerable Armoury Crate driver installed

Discovery Timeline

2026-09-08 - CVE-2026-16004 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-16004

Vulnerability Analysis

The Armoury Crate driver exposes an IOCTL interface intended for privileged hardware management operations. The driver performs verification checks on incoming IOCTL requests before allowing access to sensitive functionality. Attackers can bypass these verification checks by crafting IOCTL requests that satisfy the driver's validation logic while still invoking the sensitive code paths.

Once the verification is bypassed, the driver grants the caller the ability to read and write arbitrary PCI/PCIe configuration space. PCI/PCIe configuration space controls device identification, memory mapping, interrupt routing, and low-level hardware behavior. Unrestricted access to this interface from user mode breaks the trust boundary between unprivileged applications and hardware.

The attack requires local access and low privileges. However, the impact reaches the underlying hardware layer, which sits below the operating system's security controls. This class of driver flaw is commonly abused in bring-your-own-vulnerable-driver (BYOVD) attacks.

Root Cause

The root cause is exposed IOCTL functionality with insufficient access control [CWE-782]. The driver fails to properly restrict callers or validate the parameters supplied to sensitive IOCTL codes. This allows unprivileged callers to reach hardware-level operations reserved for kernel-mode components.

Attack Vector

An attacker with local access and standard user privileges opens a handle to the driver device object. The attacker then sends crafted DeviceIoControl requests that bypass the driver's verification routine. Successful requests invoke the PCI/PCIe configuration space read and write primitives exposed by the driver. Refer to the ASUS Security Advisory for technical remediation details.

Detection Methods for CVE-2026-16004

Indicators of Compromise

Unexpected handles opened to the Armoury Crate driver device object by non-administrative processes
Anomalous DeviceIoControl calls targeting the Armoury Crate driver from unsigned or unusual binaries
Unexplained changes to PCI/PCIe device configuration or interrupt routing
Presence of the vulnerable Armoury Crate driver on systems where the application is not required

Detection Strategies

Inventory endpoints for installed Armoury Crate driver versions and compare against the fixed versions listed in the ASUS advisory
Monitor kernel driver load events for the Armoury Crate driver and alert on unexpected hosts
Correlate process creation with subsequent driver interaction to identify BYOVD-style abuse patterns
Baseline normal IOCTL activity against the driver and flag deviations from legitimate Armoury Crate processes

Monitoring Recommendations

Enable kernel driver load auditing and forward events to a centralized analytics pipeline
Track process access to \\.\ device namespace entries associated with vendor drivers
Monitor for privilege escalation attempts and unusual hardware state changes following driver interaction
Alert when the vulnerable driver is loaded on a host that does not run the Armoury Crate application

How to Mitigate CVE-2026-16004

Immediate Actions Required

Apply the driver update referenced in the Security Update for Armoury Crate App section of the ASUS Security Advisory
Uninstall Armoury Crate on systems where the application is not required for hardware management
Restrict local logon rights on systems where the vulnerable driver cannot be updated immediately
Add the vulnerable driver hash to Microsoft's vulnerable driver blocklist where operationally feasible

Patch Information

ASUS has published remediation guidance in the ASUS Security Advisory. Administrators should review the Security Update for Armoury Crate App section for the fixed driver versions and update instructions. Deploy the updated Armoury Crate build across all affected endpoints and confirm the vulnerable driver file is replaced.

Workarounds

Remove the Armoury Crate application and its driver from systems that do not require ASUS peripheral management
Enforce Windows Defender Application Control (WDAC) policies that block loading of the vulnerable driver version
Enable Microsoft's recommended driver blocklist through Memory Integrity (HVCI) settings
Limit interactive logon on high-value systems to reduce the pool of users able to reach the local attack surface

bash

# Enable Microsoft's vulnerable driver blocklist on Windows
# Requires HVCI/Memory Integrity to be enabled
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Verify the Armoury Crate driver version present on the host
Get-CimInstance Win32_SystemDriver | Where-Object { $_.Name -like "*Armoury*" } | Select-Object Name, PathName, State