CVE-2026-6737: ASUS AsusPTPFilter Privilege Escalation

CVE-2026-6737 Overview

CVE-2026-6737 affects the AsusPTPFilter driver, a component of the ASUS Precision Touchpad software. The driver exposes an Input/Output Control (IOCTL) interface with insufficient access control checks. A local authenticated user can issue crafted IOCTL requests to bypass driver security mechanisms. Successful exploitation either discloses restricted touchpad information or renders the touchpad unusable through a denial-of-service condition. The flaw is categorized under [CWE-782] (Exposed IOCTL with Insufficient Access Control). ASUS has released a security update addressing the issue.

Critical Impact

A local user can bypass driver-level access controls through crafted IOCTL requests to leak restricted touchpad data or disable touchpad functionality.

Affected Products

• ASUS Precision Touchpad software (AsusPTPFilter driver)
• Systems running vulnerable versions of the ASUS Precision Touchpad package
• Refer to the ASUS Security Advisory for the complete list of affected versions

Discovery Timeline

• 2026-05-08 - CVE CVE-2026-6737 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-6737

Vulnerability Analysis

The vulnerability resides in the AsusPTPFilter kernel-mode driver shipped with ASUS Precision Touchpad software. The driver registers an IOCTL handler that accepts requests from user-mode callers without enforcing adequate access control on the requesting process. As a result, any local user context can reach privileged driver functionality intended only for trusted callers. Attackers leverage this exposure to retrieve restricted information from the touchpad device or to issue control codes that disrupt normal operation.

The issue is local in nature and requires the attacker to already have code execution on the affected host. It does not directly yield elevated privileges, but it weakens the trust boundary between user mode and the kernel driver. The downstream effects are limited to information exposure tied to the touchpad and a usability impact on the input device.

Root Cause

The root cause is missing or insufficient caller validation in the driver's IOCTL dispatch routine. The driver does not verify whether the requesting principal holds the required privileges before executing sensitive control codes. This pattern is classified as [CWE-782] - Exposed IOCTL with Insufficient Access Control. Drivers that expose IOCTL interfaces must validate caller identity, integrity level, or signed image context before honoring privileged commands.

Attack Vector

Exploitation requires local access and low privileges on a system where the vulnerable AsusPTPFilter driver is loaded. The attacker opens a handle to the driver device object and issues crafted IOCTL requests with specific control codes and input buffers. Depending on the code path triggered, the driver either returns information that should be restricted or transitions the touchpad into a state where it no longer responds to user input. No user interaction is required beyond the attacker's own local session.

The vulnerability is described in prose only; no verified public proof-of-concept code is available at this time. Refer to the ASUS Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-6737

Indicators of Compromise

• Unexpected loss of touchpad functionality on systems with ASUS Precision Touchpad installed, particularly after recent local process activity
• Unusual DeviceIoControl calls targeting the AsusPTPFilter device object from non-vendor processes
• Unsigned or unfamiliar user-mode binaries opening handles to the touchpad filter driver

Detection Strategies

• Monitor process creation events for unsigned binaries that interact with HID or touchpad device objects
• Audit kernel driver IOCTL interactions through Event Tracing for Windows (ETW) providers covering device I/O
• Correlate touchpad service or driver error events with concurrent local user process activity

Monitoring Recommendations

• Track installed versions of the ASUS Precision Touchpad package across the fleet and flag hosts running pre-patch builds
• Alert on repeated failed IOCTL requests against the AsusPTPFilter driver, which may indicate fuzzing or enumeration
• Review endpoint telemetry for processes opening raw handles to \\.\ device paths associated with the touchpad driver

How to Mitigate CVE-2026-6737

Immediate Actions Required

• Apply the ASUS security update for ASUS Precision Touchpad as referenced in the ASUS Security Advisory
• Inventory endpoints running the AsusPTPFilter driver and prioritize patching for laptops and convertibles with ASUS hardware
• Restrict local logon rights on affected systems to reduce the population of users able to invoke the vulnerable IOCTL

Patch Information

ASUS has published guidance under the "Security Update for ASUS Precision Touchpad" section of the ASUS Security Advisory. Administrators should download and deploy the updated ASUS Precision Touchpad package from official ASUS support channels for each affected model. Validate the driver version after installation to confirm the vulnerable build of AsusPTPFilter has been replaced.

Workarounds

• Limit interactive and remote local access to trusted administrators where patching cannot be performed immediately
• Apply application control policies to block unauthorized binaries from issuing DeviceIoControl requests against the touchpad driver
• Disable or uninstall the ASUS Precision Touchpad software on systems that do not require its advanced features until the patch is deployed

# Verify installed ASUS Precision Touchpad driver version on Windows
powershell -Command "Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like '*ASUS*Touchpad*' } | Select-Object DeviceName, DriverVersion, DriverDate"