CVE-2026-16006: Armoury Crate Driver Information Disclosure

CVE-2026-16006 Overview

CVE-2026-16006 is an information disclosure vulnerability in the ASUS Armoury Crate driver. A local authenticated user can send a crafted I/O control (IOCTL) request that bypasses the driver's verification logic. The bypass returns kernel virtual addresses to the caller, exposing details of the kernel memory layout. The weakness maps to [CWE-497] Exposure of Sensitive System Information to an Unauthorized Control Sphere. While the flaw does not directly enable code execution, leaked kernel addresses defeat Kernel Address Space Layout Randomization (KASLR) and support reliable exploitation of secondary memory-corruption bugs.

Critical Impact
Local attackers can leak kernel virtual addresses through the Armoury Crate driver, weakening KASLR and enabling exploit chains that require known kernel offsets.

Affected Products

ASUS Armoury Crate application
ASUS Armoury Crate driver component
Refer to the ASUS Security Advisory for specific driver and application versions

Discovery Timeline

2026-09-08 - CVE-2026-16006 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-16006

Vulnerability Analysis

The Armoury Crate driver exposes an IOCTL interface used by the user-mode application to query system telemetry and hardware state. One or more IOCTL handlers return data structures that contain kernel virtual addresses. The driver implements verification logic intended to restrict which callers, requests, or return values are permitted, but that verification can be bypassed with a crafted request. The result is that a low-privileged local user can read pointer values that reveal where kernel objects and modules reside in memory.

Kernel address disclosure is a foundational primitive in modern Windows exploitation. Attackers combine leaks like this one with unrelated memory-corruption vulnerabilities to reliably compute ROP gadgets, target function pointers, or overwrite kernel objects. Without a leak, KASLR forces attackers to guess or brute-force offsets, which typically bugchecks the system.

Root Cause

The root cause is insufficient enforcement in the driver's IOCTL verification path. The handler exposes kernel pointer values in its response buffer without sanitizing them and does not fully validate the conditions under which the response should be produced. This matches the [CWE-497] pattern of exposing sensitive system information across a trust boundary.

Attack Vector

Exploitation is local. An attacker requires code execution as a standard user on a Windows host that has the vulnerable Armoury Crate driver installed. The attacker opens a handle to the driver's device object and issues the crafted IOCTL. The driver returns a response containing one or more kernel virtual addresses, which the attacker parses to defeat KASLR. User interaction is not required, and the technique executes silently within a normal process context.

No public proof-of-concept exploit is listed in the CVE record. Consult the ASUS Security Advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-16006

Indicators of Compromise

Unexpected user-mode processes opening handles to the Armoury Crate driver device object outside of the legitimate ArmouryCrate.exe process tree
IOCTL activity to the Armoury Crate driver originating from unsigned or newly created binaries in user-writable directories
Short-lived processes issuing DeviceIoControl calls to the driver shortly before local privilege escalation attempts

Detection Strategies

Monitor CreateFile and DeviceIoControl activity targeting the Armoury Crate driver device name from non-vendor processes
Baseline the parent-child process relationships for legitimate Armoury Crate components and alert on deviations
Correlate kernel driver access events with subsequent suspicious behavior such as token manipulation or driver loading

Monitoring Recommendations

Enable Windows kernel object access auditing for third-party drivers on sensitive endpoints
Ingest Sysmon Event ID 1 (process creation) and Event ID 11 (file create) covering the Armoury Crate install path into a central SIEM
Track installed driver versions across the fleet and alert when vulnerable versions persist after the patch window

How to Mitigate CVE-2026-16006

Immediate Actions Required

Inventory endpoints running ASUS Armoury Crate and identify the installed driver version
Apply the fixed Armoury Crate release referenced in the ASUS Security Advisory as soon as it is validated
Restrict local logon and interactive access on systems that cannot be patched immediately
Remove Armoury Crate from systems where the application is not required for hardware management

Patch Information

ASUS has published guidance under the "Security Update for Armoury Crate App" section of the ASUS Security Advisory. Administrators should update Armoury Crate to the fixed version listed by the vendor. Uninstalling the application removes the vulnerable driver from the system.

Workarounds

Uninstall Armoury Crate on endpoints that do not require ASUS hardware tuning features
Block loading of the vulnerable driver using Windows Defender Application Control (WDAC) or a vulnerable-driver blocklist policy
Limit which local user accounts can log on interactively to workstations that retain the driver

bash

# Query installed Armoury Crate driver version on Windows endpoints
Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*Armoury*" } | Select-Object DeviceName, DriverVersion, DriverProviderName

# Remove the Armoury Crate application where not required
winget uninstall --id ASUS.ArmouryCrate