CVE-2026-16003: CWE-782: Exposed IOCTL with Insufficient Access Control in ASUS Armoury Crate

The vulnerability identified as CVE-2026-16003 in ASUS Armoury Crate involves an exposed IOCTL interface that lacks sufficient access control. A local attacker with limited privileges can craft an IOCTL request to add an arbitrary process identifier to the driver's whitelist, bypassing the intended verification mechanisms. This could potentially allow unauthorized processes to interact with the driver in ways normally restricted. The CVSS 4.0 vector indicates low attack complexity and low impact on confidentiality and integrity, with no user interaction required. No vendor advisory or patch information is provided in the input data.

The impact is limited to local users who can exploit the exposed IOCTL to add arbitrary process identifiers to the driver's whitelist, potentially enabling unauthorized interaction with the driver. The CVSS score of 2 and vector indicate low severity with high attack complexity and limited impact on system security properties. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. No specific mitigation or patch information is provided in the input data. Until a patch or official fix is available, restricting local user access and monitoring for suspicious local activity may help reduce risk.