CVE-2025-11775 is a medium-severity vulnerability classified as CWE-125 (Out-of-bounds Read) found in the asComSvc service component of ASUS Armoury Crate software, specifically affecting versions 6.3.4 and earlier. Armoury Crate is a utility primarily used on ASUS motherboards to manage hardware settings and system monitoring. The vulnerability arises when the asComSvc service processes specially crafted requests that cause it to read memory outside the intended buffer boundaries. This out-of-bounds read can lead to a service crash or partial loss of functionality, effectively causing a denial of service condition. The attack vector requires local access with low privileges (PR:L) but does not require user interaction (UI:N) or elevated privileges. The CVSS 4.8 score reflects the limited impact on confidentiality, integrity, and availability, with the main risk being service disruption rather than data compromise or remote code execution. No public exploits have been reported yet, and ASUS has reserved the CVE and published advisories recommending updates. The vulnerability is specific to ASUS motherboard series products running Armoury Crate, which is widely used in gaming and workstation environments. The lack of remote attack vector and requirement for local privilege reduces the attack surface but still poses a risk in environments where attackers can gain local access or execute code with low privileges.

For European organizations, the primary impact of CVE-2025-11775 is potential denial of service on systems running ASUS motherboards with Armoury Crate software. This could disrupt hardware monitoring and management functions, potentially affecting system stability and performance monitoring. In critical infrastructure or enterprise environments where ASUS hardware is deployed, such service disruptions could delay incident response or system maintenance activities. Although the vulnerability does not allow for privilege escalation or data theft, the loss of Armoury Crate functionality might hinder operational efficiency. Organizations relying on ASUS hardware for workstation or server tasks may experience partial outages or degraded system management capabilities. The medium severity suggests that while the threat is not immediately critical, it should not be ignored, especially in environments with sensitive or high-availability requirements.

Organizations should immediately inventory ASUS motherboard deployments and verify the Armoury Crate version installed, prioritizing those running version 6.3.4 or earlier. Since no patch links are currently provided, monitoring ASUS security advisories for official updates is critical. In the interim, restrict local access to systems with Armoury Crate installed to trusted users only, and implement strict endpoint security controls to prevent unauthorized local code execution. Consider disabling or uninstalling Armoury Crate if it is not essential to operations, reducing the attack surface. Employ application whitelisting and privilege management to limit the ability of low-privilege users or malware to interact with the asComSvc service. Additionally, enhance monitoring for service crashes or unusual behaviour related to Armoury Crate to detect potential exploitation attempts. Once patches are released, apply them promptly and validate system stability post-update.