The vulnerability in ASUS Armoury Crate allows a local administrator to bypass input validation by relying on a permissive list of allowed inputs. This flaw enables arbitrary memory read/write operations or can cause a system crash (BSOD). The weakness is classified as CWE‑183, an out‑of‑bounds read that can lead to data leakage, arbitrary code execution, or denial of service if exploited effectively.

ASUS Armoury Crate, all versions currently installed on systems where the application is running. The advisory does not specify affected releases, but any installation of the Armoury Crate app that has not been updated from the security advisory is considered vulnerable.

The CVSS score of 7.1 indicates a high severity of the flaw, with potential for privilege escalation and stability compromise. The EPSS score is not available, so the exploitation probability remains uncertain, but the lack of a public exploit and absence from the KEV catalog suggest a lower but non‑negligible risk. Because the attacker needs local administrator access, the most likely vector is an insider or compromised local user who can run the app and manipulate input values.