ASUS Armoury Crate up to 6.4.12 permissive list of allowed inputs

Summaryinfo

A vulnerability was found in ASUS Armoury Crate up to 6.4.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to permissive list of allowed inputs. This vulnerability appears as CVE-2026-8918. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability has been found in ASUS Armoury Crate up to 6.4.12 and classified as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a permissive list of allowed inputs vulnerability. The CWE definition for the vulnerability is CWE-183. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

The weakness was presented by Yuan Rui. The advisory is available at asus.com. This vulnerability was named CVE-2026-8918 since 05/19/2026. The exploitation appears to be difficult. Local access is required to approach this attack. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38205). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Rust Package

Vendor

• ASUS

Name

• Armoury Crate

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 6.4.11
• 6.4.12

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion