ASUS Fixes Another Severe Security Flaw In Armoury Crate, Update ASAP
ASUS has released a patch for its software ecosystem, fixing a critical security vulnerability in Armoury Crate. The issue, tracked as CVE-2026-8917, carries a CVSS score of 8.4 and affects an ASUS kernel driver that exposes an IOCTL interface to user-mode applications.
The core problem is that an attacker can perform arbitrary memory writes in the kernel. In other words, an application that shouldn't have any business messing with kernel memory can tell the ASUS driver what address to write to and what data to put there. Since this driver runs in the Windows kernel, it becomes a powerful primitive for escalating privileges.
Which software is affected
The affected component is used by Armoury Crate, as well as other ASUS utilities including GPU Tweak and AI Suite 3. ASUS has released updated versions of most of these apps. If you have any of this software installed, updating it should be high on your to-do list.
However, there is a catch: there doesn't appear to be an updated version of GPU Tweak II. If you need that specific one, you are left with two options: either uninstall it (and lose functionality) or stay unsecured.
Why this is dangerous
The issue is that the applications themselves don't necessarily need enormous privileges to function. But to control fans, performance modes, lighting, and other features, they require access below the normal user-mode software layer. Manufacturers install privileged services and kernel drivers to act as a bridge between their control panels and the hardware.
These bridges are huge security targets. An exploit in any of these hardware access layers can give an attacker wide-ranging administrative or even system-level access to the whole machine. While this specific flaw requires local access, all it takes is for you to approve one spurious security prompt and you're compromised.
Not just ASUS
ASUS is hardly alone here. Companies like GIGABYTE, MSI, ASRock, and even vendors like EVGA have all had numerous vulnerabilities in hardware-management software and drivers involving arbitrary memory access, insecure IOCTL interfaces, buffer overflows, and privilege escalation.
For example, GIGABYTE's GDrv drivers used by software such as APP Center and various AORUS utilities have historically exposed extremely powerful capabilities, including physical-memory and I/O-port access. CVE-2018-19320 describing the flaw was added to CISA's Known Exploited Vulnerabilities catalog, meaning the threat wasn't theoretical.
What to do
The practical advice is fairly boring: if you need these utilities, don't ignore those update prompts; keep them updated. If you don't absolutely need them, uninstall them immediately.
There are alternatives for some hardware. For example, G-Helper can replace much of ASUS's laptop and handheld management software without dragging the entire Armoury Crate ecosystem along with it. That's great for supported systems, including ROG Ally handhelds, but there isn't a universal replacement for every motherboard, GPU, and laptop on the market.
The bigger issue is simply that manufacturers need to stop treating their privileged hardware-control components as implementation details. A kernel driver with arbitrary memory access isn't just another DLL with a bug; it's part of the operating system's security boundary. Given the industry's track record, CVE-2026-8917 probably won't be the last time we have this conversation.
Гика
