CVE-2026-8070

Unauthorized Physical Memory Access via Incorrect Permission Assignment in Armoury Crate

Published May 29, 2026 CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Description

Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Analysis

Technical impact

Armoury Crate assigns incorrect permissions for a critical resource inside its driver, allowing a local user to bypass validation and read or modify physical memory. This flaw lets the attacker compromise memory stored for other processes, potentially enabling privilege escalation or corruption of system state. The vulnerability is a direct manifestations of CWE‑732, which highlights improper access control.

Affected Systems

The flaw is present in ASUS Armoury Crate applications. Specific affected versions are not listed in the advisory, so any installation of Armoury Crate is potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score is 7.3, indicating a high severity. EPSS data is unavailable, but the attack vector is local user access, which is easily achievable on a device owned by the victim. The vulnerability is not yet listed in CISA’s KEV catalog. An exploit requires only local execution and no external trigger, making this a significant risk for systems where Armoury Crate is installed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ASUS

Armoury Crate

unaffected

Version	Status	Constraints
`through 6.4.12`	affected	—

No data.

Vendor Product Versions

Asus

Armoury Crate

Version	Status	Scheme	Platform
`[0,6.4.12]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Download and install the latest Armoury Crate update from the ASUS website, which includes the corrected permission enforcement.
If an update cannot be applied immediately, remove or disable Armoury Crate from user accounts that do not require it, or uninstall the application entirely.
Implement local security controls such as AppLocker or Group Policy restrictions to prevent Armoury Crate from executing until the patch is applied.

Generated by OpenCVE AI on May 29, 2026 at 03:56 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.090% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.asus.com/security-advisory

History

Sep 17, 2026 9:00 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:asus:armoury_crate::::::::	cpe:2.3:a:asus:armoury_crate:through_6.4.12:::::::*

May 29, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 29, 2026 4:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthorized Physical Memory Access via Incorrect Permission Assignment in Armoury Crate

May 29, 2026 2:15 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
First Time appeared		Asus Asus armoury Crate
Weaknesses		CWE-732
CPEs		cpe:2.3:a:asus:armoury_crate::::::::
Vendors & Products		Asus Asus armoury Crate
References		https://www.asus.com/security-advisory
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`