CVE-2026-8919: ASUS GameSDK Information Disclosure Flaw

CVE-2026-8919 Overview

CVE-2026-8919 is a permissive cross-domain security policy vulnerability [CWE-942] in ASUS GameSDK. The flaw allows a remote attacker to obtain a local user's NT LAN Manager (NTLM) hash by convincing the user to visit a crafted web page. The malicious page sends a request containing a Universal Naming Convention (UNC) path to the application's local service endpoint, which then attempts authentication against attacker-controlled infrastructure.

Critical Impact
Exploitation results in NTLM credential disclosure, potential data tampering, denial of service against GameSDK, and lateral access to victim resources on other services.

Affected Products

ASUS GameSDK (see ASUS Security Advisory for affected versions)

Discovery Timeline

2026-07-15 - CVE-2026-8919 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-8919

Vulnerability Analysis

ASUS GameSDK exposes a local HTTP service endpoint on the user's machine. The service applies a permissive cross-origin resource sharing policy that accepts requests from untrusted domains. Any web page loaded in the victim's browser can therefore send arbitrary requests to the localhost endpoint without origin restrictions.

When the crafted request contains a UNC path such as \\attacker-controlled-host\share, the GameSDK service attempts to resolve and access that path. Windows automatically performs NTLM authentication against the remote SMB endpoint, transmitting the current user's NTLMv2 hash to the attacker's server.

The attacker can then crack the hash offline or relay it in real time to authenticate against internal services. Exploitation requires only that the target visit a web page, making the vector suitable for phishing or watering-hole campaigns.

Root Cause

The root cause is a permissive Cross-Origin Resource Sharing (CORS) configuration on GameSDK's local service. The endpoint fails to validate the Origin header or restrict acceptable domains, and it does not sanitize UNC paths in incoming request parameters before file-system access.

Attack Vector

The attack chain proceeds as follows. The victim visits a malicious or compromised web page while GameSDK runs locally. The page issues a cross-origin request to the GameSDK localhost endpoint containing a UNC path pointing to an attacker-controlled SMB server. GameSDK triggers a file access to that path, and Windows initiates NTLM authentication, leaking the user's hashed credentials. See the ASUS Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-8919

Indicators of Compromise

Outbound SMB (TCP 445) or NetBIOS traffic from endpoints running GameSDK to unexpected external IP addresses
Browser process making HTTP requests to GameSDK localhost ports followed by SMB session initiation
Windows Security Event ID 4624/4625 entries showing NTLM authentication attempts to non-corporate destinations

Detection Strategies

Monitor for cross-origin HTTP requests from browser processes to GameSDK's local service endpoint that contain UNC-style parameter values (\\ or // prefixes)
Alert on any workstation initiating outbound SMB connections to internet-routable addresses, which is anomalous in most enterprise environments
Correlate browser navigation events with subsequent NTLM authentication attempts on the same host within a short time window

Monitoring Recommendations

Enable network egress filtering to block outbound TCP 445 and 139 at the perimeter firewall
Deploy Endpoint Detection and Response (EDR) telemetry to capture process-to-process interaction between browsers and the GameSDK service
Log and review all HTTP requests to GameSDK's local listener, including full URIs and request bodies

How to Mitigate CVE-2026-8919

Immediate Actions Required

Apply the security update referenced in the ASUS Security Advisory as soon as it is available for your GameSDK version
Block outbound SMB traffic (TCP 445, TCP/UDP 139) at the network perimeter to prevent NTLM hash exfiltration
Consider temporarily uninstalling or disabling ASUS GameSDK on managed endpoints until patches are deployed

Patch Information

ASUS has published remediation guidance under the "Security Update for ASUS GameSDK" section of the ASUS Security Advisory. Administrators should review the advisory for the fixed version numbers and apply updates through ASUS's standard distribution channels.

Workarounds

Enforce the Windows Group Policy setting Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers set to Deny all
Configure host-based firewall rules to restrict access to the GameSDK localhost service to authorized processes only
Educate users to avoid clicking untrusted links while GameSDK-enabled applications are running

bash

# Example: Block outbound SMB via Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 445 \
  -Action Block \
  -Profile Any