The vulnerability CVE-2026-8919 in ASUS GameSDK arises from a permissive cross-domain security policy that accepts requests from untrusted domains. This flaw enables a remote attacker to obtain a local user's NTLM hash by convincing the user to access a malicious web page that triggers a request containing a UNC path to the local GameSDK service endpoint. The exposure of NTLM hashes can lead to credential theft, and the vulnerability may also cause information disclosure, data tampering, and service unavailability. The CVSS 4.0 base score is 7.2, indicating high severity. No official patch or remediation level has been published by ASUS at this time. The vulnerability is not related to a cloud service, and no known exploits are reported in the wild.

Successful exploitation can disclose a local user's NTLM hash, which may be used for credential theft or lateral movement. It can also result in information disclosure, data tampering, and cause the ASUS GameSDK service to become unavailable. Additionally, attackers may gain unauthorized access to the victim's information on other services relying on these credentials or the compromised service.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, users should exercise caution when visiting untrusted web pages and consider restricting access to the local GameSDK service endpoint if possible. Monitor ASUS advisories for updates.