CVE-2026-19398: CWE-787: Out-of-bounds Write in ASUS FA507NV

This vulnerability involves an out-of-bounds write (CWE-787) in the SmiFlash System Management Mode (SMM) module of ASUS FA507NU and FA507NV BIOS. A local administrator can trigger this flaw by issuing a crafted software System Management Interrupt (SW SMI) request with an oversized length parameter, which may lead to a system crash (Blue Screen of Death) or BIOS corruption. The affected BIOS version is 318. The vulnerability has a CVSS 4.0 score of 6.8, reflecting medium impact with local attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is currently available.

Successful exploitation can cause a system crash (BSOD) or corrupt the BIOS firmware, potentially requiring recovery actions. The attack requires local administrator privileges and does not involve user interaction. There is no indication of remote exploitation or privilege escalation beyond local administrator.

Patch status is not yet confirmed — check the ASUS Security Advisory for the FA507NV / FA507NU BIOS for current remediation guidance. Until a patch is available, restrict local administrator access and avoid executing untrusted software that could trigger crafted SW SMI requests.