CVE-2026-16727

Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Ejecución concurrente utilizando un recurso compartido con sincronización inadecuada (condición de carrera) en ASUS Armoury Crate permite a un usuario local ejecutar código arbitrario con privilegios elevados mediante la sustitución de un archivo manipulado. Consulte la sección ’Actualización de seguridad para ASUS Armoury Crate’ en el Aviso de Seguridad de ASUS para más información.

Information

Published : 2026-07-30 02:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-16727

Mitre link : CVE-2026-16727

CVE.ORG link : CVE-2026-16727

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-16727", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16727", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "Armoury Crate", "versions": [{"status": "affected", "version": "V5.4.1", "versionType": "custom", "lessThanOrEqual": "V6.4.12"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T02:16:45.537", "references": [{"url": "https://www.asus.com/security-advisory", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u201cRace Condition\u201d) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement.\nRefer to the '\u00a0Security Update for ASUS Armoury Crate\u00a0' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Ejecuci\u00f3n concurrente utilizando un recurso compartido con sincronizaci\u00f3n inadecuada (condici\u00f3n de carrera) en ASUS Armoury Crate permite a un usuario local ejecutar c\u00f3digo arbitrario con privilegios elevados mediante la sustituci\u00f3n de un archivo manipulado.\nConsulte la secci\u00f3n \u2019Actualizaci\u00f3n de seguridad para ASUS Armoury Crate\u2019 en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}