An uncontrolled search path element flaw lets local users replace a DLL used by a high‑privilege process in ASUS Armoury Crate. By hijacking the DLL load sequence, an attacker can cause the process to run arbitrary code with SYSTEM permissions. The vulnerability can be exploited without remote access, as it relies solely on local capabilities. It is classified as CWE‑427 due to the manipulation of the search path.

Armoury Crate and Armoury Crate SE from ASUS are affected. The vulnerability exists in all installed versions where the application loads DLLs without proper validation. Exact version ranges are not listed, so any instance of the Armoury Crate software that performs DLL loading is potentially vulnerable.

The CVSS score of 8.5 indicates high severity. Because the exploit requires local user access, the EPSS score is not provided, but the weakness remains concerning for environments where local users have read/write persistence. The vulnerability is not yet in the CISA KEV catalog, but patching should be prioritized due to the high privilege elevation it offers.