CVE-2026-18023: ASUS Armoury Crate Information Disclosure

CVE-2026-18023 Overview

CVE-2026-18023 is an information disclosure vulnerability in the ASUS Armoury Crate driver. A local user can send a crafted IOCTL request that bypasses the driver's security verification mechanism and returns uninitialized kernel memory contents. The flaw is classified under [CWE-226] (Sensitive Information in Resource Not Removed Before Reuse). Successful exploitation exposes sensitive data that may include kernel pointers, credentials, or other memory artifacts useful for follow-on attacks such as local privilege escalation. ASUS has published guidance in the Security Update for Armoury Crate App section of its advisory portal.

Critical Impact
A local attacker with low privileges can read uninitialized kernel memory through the vulnerable driver, disclosing sensitive information that supports further exploitation.

Affected Products

ASUS Armoury Crate driver (see vendor advisory for affected versions)
ASUS Armoury Crate App on Windows systems
Systems shipped with ASUS ROG and TUF hardware bundles that install Armoury Crate

Discovery Timeline

2026-09-08 - CVE-2026-18023 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-18023

Vulnerability Analysis

The ASUS Armoury Crate driver exposes an IOCTL (Input/Output Control) interface to user mode. The driver includes a security verification mechanism intended to restrict which callers can issue privileged IOCTLs. A crafted IOCTL request bypasses this check and reaches a code path that returns a buffer to user mode without fully initializing it.

Because the returned buffer is not zeroed or fully populated before being copied out, its residual bytes contain data from prior kernel allocations. The caller can read this uninitialized memory directly from user space. The disclosed content varies with system activity and can include kernel pointers, driver state, and fragments of other processes' data.

This category of flaw maps to [CWE-226] and is a well-known driver hygiene issue in Windows kernel components that use METHOD_BUFFERED or METHOD_OUT_DIRECT I/O without pre-zeroing the output buffer.

Root Cause

The root cause is twofold. First, the driver's verification routine fails to reject a specific IOCTL pattern, allowing an unauthorized caller to invoke a protected handler. Second, that handler returns kernel memory without clearing residual contents, violating the principle that resources must be scrubbed before reuse across trust boundaries.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker opens a handle to the driver's device object and issues DeviceIoControl calls with the crafted control code and input parameters that satisfy the bypass condition. The driver returns a buffer whose uninitialized regions leak kernel memory contents to the caller. The attack complexity is rated high, reflecting timing or environmental conditions needed to obtain useful data.

No verified public proof-of-concept code is available. See the ASUS Security Advisory for vendor technical details.

Detection Methods for CVE-2026-18023

Indicators of Compromise

Unexpected user-mode processes opening handles to Armoury Crate driver device objects outside of the legitimate ArmouryCrate.exe process tree.
High-frequency DeviceIoControl calls from non-ASUS processes targeting Armoury Crate driver control codes.
Presence of outdated Armoury Crate driver binaries after the vendor patch release date.

Detection Strategies

Inventory installed kernel drivers and compare Armoury Crate driver versions against the fixed version listed in the ASUS advisory.
Hunt for processes loading or communicating with the Armoury Crate device object that are not signed by ASUS or spawned by the Armoury Crate service.
Alert on non-interactive or low-integrity processes issuing IOCTLs to third-party hardware utility drivers.

Monitoring Recommendations

Enable kernel driver load auditing and forward events to a centralized logging platform for baselining.
Monitor Sysmon Event ID 6 (driver loaded) and Event ID 10 (process access) for anomalous interactions with the Armoury Crate driver.
Track privilege escalation attempts and unusual memory access patterns on endpoints where Armoury Crate is installed.

How to Mitigate CVE-2026-18023

Immediate Actions Required

Apply the Armoury Crate App update referenced in the ASUS Security Advisory as soon as it becomes available for your product line.
Identify all endpoints with Armoury Crate installed and prioritize patching on multi-user or shared workstations.
Restrict local logon rights on affected systems to reduce the population of users who can invoke the vulnerable IOCTL.

Patch Information

ASUS has released a security update for the Armoury Crate App. Refer to the Security Update for Armoury Crate App section of the ASUS Security Advisory for affected versions and fixed builds. Update through the Armoury Crate application's built-in updater or by downloading the latest installer from the ASUS support site for the specific device model.

Workarounds

Uninstall the Armoury Crate App and its associated driver on systems that do not require ASUS hardware control features.
Block loading of the vulnerable driver version using Windows Defender Application Control (WDAC) or AppLocker driver rules.
Limit local user accounts and enforce least privilege to reduce the number of principals able to issue IOCTLs to the driver.

bash

# Example: query installed Armoury Crate driver version on Windows via PowerShell
Get-WmiObject Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like "*Armoury*" -or $_.DriverProviderName -like "*ASUS*" } |
  Select-Object DeviceName, DriverVersion, DriverProviderName, InfName