An out-of-bounds read occurs in the IOCTL handler of the ASUS System Control Interface, allowing a local user to read beyond the intended buffer. The result is a system crash (BSOD), causing a denial of service. The flaw maps to CWE‑125, a buffer overread condition.

The affected product is the ASUS System Control Interface on ASUS devices. No specific firmware or model versions are listed, so users should consult the ASUS Security Advisory for details and verify whether their system exposes the vulnerable IOCTL interface.

The CVSS score of 6.8 indicates a moderate severity for a local exploit that requires user privilege. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is uncertain. An attacker would need local user access to send the vulnerable IOCTL request, limiting the threat to devices with accessible local accounts.