CVE-2026-75809: ASUS Armoury Crate Information Disclosure

CVE-2026-75809 is an information disclosure flaw in ASUS Armoury Crate that allows local attackers to access sensitive data and disable device functionality through exposed IOCTL with insufficient access control. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-75809 Overview

CVE-2026-75809 affects ASUS Armoury Crate, exposing an IOCTL interface with insufficient access control. A local user can bypass driver authentication and issue IOCTLs that read from and write to PCIe configuration space. The flaw enables information disclosure and can disable device functionality on affected systems. The weakness is categorized under [CWE-782] (Exposed IOCTL with Insufficient Access Control). ASUS has published a Security Advisory covering the Armoury Crate App update that addresses this issue.

Critical Impact
A local, low-privileged user can bypass driver authentication and directly manipulate PCIe configuration space, leading to information disclosure and impaired device functionality.

Affected Products

ASUS Armoury Crate App (see ASUS Security Advisory for affected build ranges)
Bundled ASUS Armoury Crate driver components exposing the vulnerable IOCTL
Windows systems running ASUS Armoury Crate for hardware management

Discovery Timeline

2026-09-08 - CVE-2026-75809 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75809

Vulnerability Analysis

ASUS Armoury Crate installs a signed kernel-mode driver that exposes IOCTL handlers to user mode. The vulnerable handler does not adequately validate the calling process before granting access to privileged operations. A local user can send crafted IOCTLs that bypass the driver's authentication check.

Once access is granted, the IOCTLs allow arbitrary reads from and writes to PCIe configuration space. PCIe configuration space controls device identification, capability registers, base address registers (BARs), and command bits that gate memory and DMA access. Manipulating these fields exposes hardware identifiers and configuration data, and can render devices non-functional by disabling memory decoding or resetting device state.

Root Cause

The root cause is improper access control on an exposed IOCTL interface, classified as [CWE-782]. The driver relies on a client-side or trivially bypassable authentication scheme rather than enforcing a kernel-side security descriptor or verifying the caller's integrity level and signature.

Attack Vector

Exploitation requires local access and low privileges. An attacker opens a handle to the driver's device object and issues DeviceIoControl calls that trigger the authentication-bypass path, then invokes the read and write PCIe configuration space IOCTLs. No user interaction is required. Attack complexity is elevated because the attacker must reverse the authentication handshake and identify valid IOCTL codes and PCIe targets. No public proof-of-concept or in-the-wild exploitation has been reported.

Refer to the ASUS Security Advisory for technical details on the affected IOCTLs and driver components.

Detection Methods for CVE-2026-75809

Indicators of Compromise

Unexpected user-mode processes opening handles to the ASUS Armoury Crate driver device object outside the legitimate ArmouryCrate.exe process tree.
Sudden loss of function on internal PCIe devices (GPU, NIC, storage controller) shortly after unsigned or unusual local process activity.
Event Log entries showing driver load or IOCTL failures correlated with non-ASUS parent processes.

Detection Strategies

Monitor process creation and handle open events targeting the Armoury Crate driver device name, filtering out signed ASUS binaries.
Alert on non-ASUS processes issuing DeviceIoControl against the vulnerable driver, especially from user-writable directories.
Correlate PCIe device state changes reported by Windows Plug and Play with recent local process activity.

Monitoring Recommendations

Baseline which processes are expected to interact with the Armoury Crate driver and alert on deviations.
Track driver version telemetry across the fleet to confirm patched builds are deployed.
Ingest Windows kernel and PnP event logs into a central data lake for retroactive hunting on IOCTL abuse patterns.

How to Mitigate CVE-2026-75809

Immediate Actions Required

Update ASUS Armoury Crate to the version listed in the ASUS Security Advisory as remediating CVE-2026-75809.
Inventory endpoints with ASUS Armoury Crate installed and prioritize patching for shared or multi-user systems.
Restrict local logon rights on affected hosts to reduce the pool of users able to reach the vulnerable IOCTL.

Patch Information

ASUS has issued a Security Update for the Armoury Crate App. Refer to the ASUS Security Advisory under the "Security Update for Armoury Crate App" section for the fixed version and download links. Apply the update through Armoury Crate's built-in updater or by installing the latest release from the official ASUS support site.

Workarounds

Uninstall ASUS Armoury Crate on systems that do not require its hardware management functionality until the patch is applied.
Block loading of the vulnerable driver using Windows Defender Application Control (WDAC) or a driver blocklist policy where feasible.
Limit interactive and remote local access to trusted administrators on hosts where the software must remain installed.

bash

# Example: query installed Armoury Crate version on Windows via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like '*Armoury Crate*' } |
  Select-Object DisplayName, DisplayVersion, Publisher