CVE-2026-8070: Armoury Crate Privilege Escalation Flaw

CVE-2026-8070 Overview

CVE-2026-8070 is an incorrect permission assignment vulnerability [CWE-732] affecting the ASUS Armoury Crate application. The flaw resides in a driver component shipped with Armoury Crate. A local user can bypass the driver's validation mechanism and obtain unauthorized read and write access to physical memory. The issue is tracked under the ASUS Security Advisory section titled Security Update for Armoury Crate App.

Critical Impact
Local attackers can read and write arbitrary physical memory, enabling kernel-level compromise, credential theft, and full host takeover from a standard user context.

Affected Products

ASUS Armoury Crate App (driver component)
Refer to the ASUS Security Advisory for the specific affected versions
Windows systems with vulnerable Armoury Crate installations

Discovery Timeline

2026-05-29 - CVE-2026-8070 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-8070

Vulnerability Analysis

The vulnerability resides in a kernel-mode driver bundled with the ASUS Armoury Crate application. The driver exposes an interface that performs validation before allowing memory access operations. Incorrect permission assignment on this interface lets a local user invoke the privileged functionality without satisfying the intended access controls.

Because the driver operates in kernel mode and brokers access to physical memory, bypassing its validation grants the caller direct read and write primitives over RAM. An attacker with these primitives can locate kernel structures, modify token privileges, disable security callbacks, or extract secrets such as LSASS-resident credentials. The flaw maps to [CWE-732] Incorrect Permission Assignment for Critical Resource. The CVE carries an EPSS percentile of 3.049, indicating a low current probability of observed exploitation activity.

Root Cause

The driver assigns overly permissive access rights to its device object or IOCTL handlers. Standard users can open a handle to the driver and issue requests that should be restricted to privileged callers. The driver's validation routine fails to enforce the intended security boundary on these requests.

Attack Vector

Exploitation requires local access with low privileges. An attacker who can execute code on the target host opens a handle to the vulnerable driver device, then issues crafted I/O control requests to invoke the memory read and write primitives. No user interaction is required, but the attack complexity is elevated because the attacker must shape requests that pass partial validation while reaching the unprotected memory operations.

The vulnerability is described in prose only because no public proof-of-concept code is available. See the ASUS Security Advisory for vendor-confirmed details.

Detection Methods for CVE-2026-8070

Indicators of Compromise

Unexpected handles opened against the Armoury Crate driver device object by non-Armoury processes.
Kernel driver load events for the Armoury Crate driver on hosts where the application is not actively in use.
Sudden privilege elevation of standard user processes shortly after Armoury Crate driver interaction.

Detection Strategies

Inventory endpoints running Armoury Crate and correlate driver versions against the ASUS advisory's fixed builds.
Monitor DeviceIoControl calls to the Armoury Crate driver from processes outside the expected Armoury Crate parent chain.
Alert on processes that obtain SYSTEM or kernel-level capabilities after interacting with the driver.

Monitoring Recommendations

Enable kernel driver load auditing through Windows Event Log (Microsoft-Windows-Kernel-PnP) and forward to your SIEM.
Track \\.\ device namespace opens targeting the Armoury Crate driver and baseline expected callers.
Review EDR telemetry for token manipulation, credential dumping, or LSASS access following Armoury Crate driver activity.

How to Mitigate CVE-2026-8070

Immediate Actions Required

Apply the patched version of Armoury Crate from the ASUS Security Advisory on all affected endpoints.
Uninstall Armoury Crate on systems where it is not required, particularly on shared workstations and servers.
Restrict local logon and standard user code execution on hosts that retain vulnerable Armoury Crate builds until patched.

Patch Information

ASUS has published guidance under the Security Update for Armoury Crate App section of its advisory portal. Administrators should review the ASUS Security Advisory for the fixed version numbers and download links, then deploy through standard software distribution tooling.

Workarounds

Remove or disable the vulnerable driver service until the official patch is deployed.
Apply application allowlisting to prevent unauthorized processes from opening handles to the Armoury Crate driver device.
Enforce least privilege so that standard users cannot persist tools required to exercise the local attack chain.

bash

# Verify Armoury Crate presence and driver status on Windows hosts
Get-Package -Name "*Armoury Crate*" | Select-Object Name, Version
Get-Service | Where-Object { $_.Name -like "*AsusCert*" -or $_.Name -like "*Armoury*" }
# Stop and disable the vulnerable driver service (replace <ServiceName> with the identified service)
Stop-Service -Name <ServiceName> -Force
Set-Service -Name <ServiceName> -StartupType Disabled