ASUS motherboards firmware contain an untrusted pointer dereference that allows a user who already has kernel‑level privileges to supply an arbitrary memory address through an I/O command. If the provided address is valid, the firmware can overwrite critical system information, potentially altering firmware behavior, or cause a system crash when the address is invalid or otherwise mis‑handled. The vulnerability is identified as CWE‑822 and can lead to integrity violations and availability impacts for affected systems.

Affected systems are ASUS motherboards from the A520/B550 series (firmware versions before 3644/4304), A620/A620A series (before 4003/4004), B650 series (before 1303/4003/4004), B840 series (before 1804), B850 series (before 1103/1804/2503), Knoll series (before 4003), TRX50 series (before 0703/1403), W790 series (before 2101), WRX90 series (before 1403), X570 series (before 5054), X670 series (before 4003/4004), X870 series (before 1804/2503), and X870E series (before 1103/2503). Firmware updates that remove or guard the vulnerable pointer dereference are provided by ASUS.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires local kernel‑level privilege; thus only a user with administrative or similar access can trigger the flaw. This reduces the attack surface but still poses a serious risk to systems that have not been patched because it can result in critical data corruption or a crash, affecting confidentiality, integrity, and availability.