CVE-2026-8918: ASUS Armoury Crate Privilege Escalation

CVE-2026-8918 Overview

CVE-2026-8918 affects ASUS Armoury Crate, a system management utility bundled with ASUS hardware. A permissive list of allowed inputs in the application enables a local administrator to bypass its validation mechanism. The bypass permits arbitrary memory read and write operations or can trigger a system crash resulting in a Blue Screen of Death (BSOD). The flaw is categorized under [CWE-183] Permissive List of Allowed Inputs and requires local access with high privileges. ASUS has published guidance under the Security Update for Armoury Crate App section of its security advisory.

Critical Impact
A local administrator can bypass Armoury Crate input validation to perform arbitrary kernel memory read/write or crash the host system.

Affected Products

ASUS Armoury Crate App (versions prior to the fixed release referenced in the ASUS Security Advisory)
Windows systems with ASUS Armoury Crate installed
ASUS hardware shipping with Armoury Crate pre-loaded

Discovery Timeline

2026-06-22 - CVE-2026-8918 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-8918

Vulnerability Analysis

The vulnerability resides in the input validation logic of ASUS Armoury Crate. The application enforces a list of accepted inputs to gate privileged operations exposed through its driver or service interface. The list is overly permissive, accepting input patterns that should have been rejected. An attacker who already holds administrator privileges can craft requests that satisfy the relaxed validation and reach the underlying privileged handlers.

Once the validation is bypassed, the attacker gains the ability to issue memory read and write primitives against arbitrary addresses. These primitives operate at the privilege level of the underlying driver, which typically runs in kernel mode. Malformed inputs reaching the same code paths can also corrupt kernel state and force a BSOD, producing a denial of service condition on the host.

Root Cause

The root cause is classified as [CWE-183] Permissive List of Allowed Inputs. The allowlist used by Armoury Crate to validate caller-supplied data accepts entries that should not be considered safe. The validation layer treats these inputs as legitimate and forwards them to lower-level routines that perform privileged memory operations without re-checking bounds or intent.

Attack Vector

Exploitation requires local access and an administrator-level account on the target host. The attacker interacts with the Armoury Crate driver or service through its standard IOCTL or IPC surface. By submitting inputs that pass the permissive allowlist, the attacker invokes privileged operations the validation layer was meant to block. Successful exploitation yields arbitrary kernel memory read/write, which can be chained into kernel code execution, credential theft, or persistence. Failed or malformed inputs reaching the same path produce a system crash.

No public proof-of-concept code is currently available. Refer to the ASUS Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-8918

Indicators of Compromise

Unexpected BSOD events on hosts running ASUS Armoury Crate, particularly with bugcheck codes referencing the Armoury Crate driver.
Loading or interaction with Armoury Crate kernel driver components from non-standard processes or scripts.
Administrator processes opening handles to Armoury Crate device objects outside of normal application use.

Detection Strategies

Monitor DeviceIoControl calls targeting Armoury Crate driver device names from processes other than the legitimate Armoury Crate binaries.
Inventory endpoints to identify hosts running vulnerable Armoury Crate versions and flag deviations from the patched baseline.
Correlate administrator logons with subsequent driver interaction events to surface privilege abuse patterns.

Monitoring Recommendations

Enable Windows kernel crash dump collection and review bugchecks involving Armoury Crate driver modules.
Track installation, update, and version state of Armoury Crate through endpoint management tooling.
Alert on creation of new services or scheduled tasks that invoke Armoury Crate components outside vendor update workflows.

How to Mitigate CVE-2026-8918

Immediate Actions Required

Update ASUS Armoury Crate to the version identified in the Security Update for Armoury Crate App section of the ASUS Security Advisory.
Audit which endpoints have Armoury Crate installed and prioritize patching on systems where local administrators are not tightly controlled.
Restrict local administrator membership to reduce the population of accounts able to reach the vulnerable interface.

Patch Information

ASUS has released a security update for Armoury Crate. Apply the fixed version referenced in the ASUS Security Advisory. After patching, verify the installed version on each endpoint to confirm remediation.

Workarounds

Uninstall ASUS Armoury Crate on systems where it is not required for hardware management.
Disable or stop the Armoury Crate service and associated drivers until the patch is applied.
Enforce least privilege so that day-to-day accounts do not hold local administrator rights on hosts with Armoury Crate installed.

bash

# Verify installed Armoury Crate version on Windows
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*Armoury Crate*" } |
  Select-Object DisplayName, DisplayVersion, Publisher