An Out-of-Bounds Read vulnerability (CWE‑125) exists in the ASUS Business System Control Interface driver. An unprivileged local user can trigger the flaw by sending a specially crafted IOCTL request, which may result in the disclosure of kernel data or cause a system crash. The primary impact is the leakage of kernel information, potentially compromising confidentiality, with a secondary denial‑of‑service risk if the system becomes unstable.

The vulnerability affects the ASUS Business System Control Interface product. No specific affected versions are listed in the CVE data, so all releases prior to the advisory may be susceptible. The provided CPE string (cpe:2.3:a:asus:asus_business_system_control_interface:*:*:*:*:*:*:*:*) indicates the scope of the affected product.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, further reducing the overall risk profile. The attack vector is local and requires an unprivileged user to send the crafted IOCTL; therefore, remote exploitation is not possible without first gaining local access.