CVE-2026-75808: ASUS Armoury Crate DOS Vulnerability

CVE-2026-75808 Overview

CVE-2026-75808 is a resource allocation vulnerability in ASUS Armoury Crate. A local user can bypass driver authentication and allocate unrestricted amounts of system memory. The condition triggers memory exhaustion and produces a denial-of-service (DoS) state on the affected host. The weakness maps to [CWE-770] (Allocation of Resources Without Limits or Throttling). ASUS documents the fix in the Security Update for Armoury Crate App section of its security advisory.

Critical Impact
A local authenticated user can exhaust system memory by bypassing the Armoury Crate driver authentication and issuing unbounded allocation requests, rendering the host unresponsive.

Affected Products

ASUS Armoury Crate application
ASUS Armoury Crate driver component
Windows systems running vulnerable Armoury Crate builds

Discovery Timeline

2026-09-08 - CVE-2026-75808 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75808

Vulnerability Analysis

The flaw sits in the ASUS Armoury Crate kernel driver interface. Armoury Crate uses a driver authentication scheme intended to restrict IOCTL access to the legitimate user-mode application. A local user can bypass this authentication check and issue driver requests directly.

Once the authentication gate is defeated, the attacker can invoke memory allocation paths without the bounds enforcement expected from a trusted caller. The driver honors the request and allocates memory sized by attacker-controlled input.

Repeated or oversized allocations exhaust available system memory. The operating system loses the ability to service legitimate processes, resulting in a denial-of-service condition. Recovery typically requires a reboot.

Root Cause

The root cause is a missing quota or throttling control on a driver code path that performs allocations on behalf of user-mode callers. The driver's authentication check can be bypassed, so allocations proceed without the guardrails assumed by the design. The combination produces uncapped kernel or system pool consumption from an unprivileged local context.

Attack Vector

Exploitation requires local access with low privileges. No user interaction is needed. The attacker opens a handle to the Armoury Crate driver, bypasses the authentication handshake, and issues allocation requests through the exposed IOCTL surface. Sustained requests drive the target into memory exhaustion. The attack does not disclose data or execute code; the impact is limited to availability.

No public proof-of-concept is listed in the advisory. Technical specifics of the authentication bypass are documented by ASUS in its ASUS Security Advisory.

Detection Methods for CVE-2026-75808

Indicators of Compromise

Sudden, sustained growth of nonpaged pool or committed memory tied to processes interacting with the Armoury Crate driver.
Unexpected user-mode processes opening handles to the Armoury Crate driver device object outside of the signed application.
System hangs, out-of-memory events, or forced reboots correlating with Armoury Crate driver activity in the Windows Event Log.

Detection Strategies

Monitor kernel driver IOCTL activity for non-standard callers targeting the Armoury Crate driver device.
Alert on rapid, repeated allocation calls from a single low-privilege process against the driver interface.
Baseline normal Armoury Crate memory footprint and flag deviations exceeding that baseline.

Monitoring Recommendations

Ingest Windows performance counters for Memory\Pool Nonpaged Bytes and Memory\Committed Bytes into your SIEM and alert on rapid climbs.
Collect Sysmon Event ID 1 (process create) and driver-load telemetry to identify unauthorized processes touching Armoury Crate components.
Track version inventory of ArmouryCrate.exe and its driver across endpoints to confirm patch coverage.

How to Mitigate CVE-2026-75808

Immediate Actions Required

Update ASUS Armoury Crate to the fixed release documented in the ASUS Security Advisory Security Update for Armoury Crate App section.
Inventory endpoints running Armoury Crate and prioritize shared or multi-user systems for immediate patching.
Restrict local logon rights on affected hosts to reduce the population able to reach the driver interface.

Patch Information

ASUS has published a fixed version of Armoury Crate. Refer to the ASUS Security Advisory and apply the update identified in the Security Update for Armoury Crate App section. Verify the installed application and driver versions after deployment.

Workarounds

Uninstall Armoury Crate on systems where the utility is not required for hardware management.
Disable or unload the Armoury Crate kernel driver until the patched version is deployed.
Limit interactive local access on systems that must retain a vulnerable Armoury Crate build.

bash

# Verify Armoury Crate version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Armoury Crate*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Optional: stop and disable the Armoury Crate service pending patch
Stop-Service -Name "ArmouryCrateService" -Force
Set-Service -Name "ArmouryCrateService" -StartupType Disabled