CVE-2026-18023

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Información sensible en un recurso no eliminada antes de su reutilización en el controlador ASUS Armoury Crate permite a un usuario local divulgar información sensible de memoria no inicializada a través de una solicitud IOCTL manipulada que elude el mecanismo de verificación de seguridad del controlador. Consulte la sección 'Actualización de seguridad para la aplicación Armoury Crate' en el Aviso de seguridad de ASUS para más información.

Information

Published : 2026-09-08 03:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-18023

Mitre link : CVE-2026-18023

CVE.ORG link : CVE-2026-18023

JSON object : View

Products Affected

No product.

CWE

CWE-226

Sensitive Information in Resource Not Removed Before Reuse

{"id": "CVE-2026-18023", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18023", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T13:53:09.573173Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "Armoury Crate", "versions": [{"status": "affected", "version": "through 6.5.7", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T03:17:18.050", "references": [{"url": "https://www.asus.com/security-advisory", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-226"}]}], "descriptions": [{"lang": "en", "value": "Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism.\nRefer to the '\nSecurity Update for Armoury Crate App\u00a0' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Informaci\u00f3n sensible en un recurso no eliminada antes de su reutilizaci\u00f3n en el controlador ASUS Armoury Crate permite a un usuario local divulgar informaci\u00f3n sensible de memoria no inicializada a trav\u00e9s de una solicitud IOCTL manipulada que elude el mecanismo de verificaci\u00f3n de seguridad del controlador.\nConsulte la secci\u00f3n 'Actualizaci\u00f3n de seguridad para la aplicaci\u00f3n Armoury Crate' en el Aviso de seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}