CVE-2026-16004: CWE-782: Exposed IOCTL with Insufficient Access Control in ASUS Armoury Crate

The vulnerability identified as CVE-2026-16004 involves an exposed IOCTL interface in the ASUS Armoury Crate driver that lacks sufficient access control. This allows a local user with low privileges to craft IOCTL requests that bypass the driver's verification mechanisms, enabling arbitrary read and write access to PCI/PCIe configuration space. The CVSS 4.0 base score is 5.9 (medium severity), reflecting the local attack vector, high attack complexity, and the requirement for low privileges but no user interaction. The vulnerability could potentially allow unauthorized modification of hardware configuration registers via the driver interface.

A local attacker with low privileges can exploit this vulnerability to read and write arbitrary PCI/PCIe configuration space, potentially leading to unauthorized hardware configuration changes. This could impact system stability or security depending on the hardware and system context. However, exploitation requires local access and a high level of attack complexity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the Armoury Crate driver. Follow ASUS vendor advisories for updates and apply security updates promptly once released.