CVE-2026-8918

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

CVSS

No CVSS.

References

Link	Resource
https://www.asus.com/security-advisory

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una lista permisiva de entradas permitidas en ASUS Armoury Crate permite a un administrador local realizar operaciones arbitrarias de lectura/escritura en memoria o provocar un fallo del sistema (BSOD) al eludir el mecanismo de validación. Consulte la sección ’Actualización de seguridad para la aplicación Armoury Crate’ en el Aviso de Seguridad de ASUS para más información.

Information

Published : 2026-06-22 03:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-8918

Mitre link : CVE-2026-8918

CVE.ORG link : CVE-2026-8918

JSON object : View

Products Affected

No product.

CWE

CWE-183

Permissive List of Allowed Inputs

{"id": "CVE-2026-8918", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8918", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "affectedData": [{"vendor": "ASUS", "product": "Armoury Crate", "versions": [{"status": "affected", "version": "through 6.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T03:16:43.070", "references": [{"url": "https://www.asus.com/security-advisory", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "description": [{"lang": "en", "value": "CWE-183"}]}], "descriptions": [{"lang": "en", "value": "A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the '\nSecurity Update for Armoury Crate App\u00a0' section on the ASUS Security Advisory for more information."}, {"lang": "es", "value": "Una lista permisiva de entradas permitidas en ASUS Armoury Crate permite a un administrador local realizar operaciones arbitrarias de lectura/escritura en memoria o provocar un fallo del sistema (BSOD) al eludir el mecanismo de validaci\u00f3n. Consulte la secci\u00f3n \u2019Actualizaci\u00f3n de seguridad para la aplicaci\u00f3n Armoury Crate\u2019 en el Aviso de Seguridad de ASUS para m\u00e1s informaci\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}