The vulnerability CVE-2026-8920 in ASUS Aura Wallpaper Service version 2.1.8.0 is caused by improper restriction of communication channels to intended endpoints (CWE-923) and external control of file name or path (CWE-73). This flaw enables a local attacker with limited privileges to bypass path restrictions by sending crafted commands containing arbitrary file paths to the service, resulting in unauthorized file operations. Additionally, on specific ASUS models, exploitation may cause a single feature of the service to become unavailable. The CVSS 4.0 base score is 8.5, reflecting high impact with local attack vector, high complexity, and significant confidentiality, integrity, and availability impacts. No official patch or remediation level has been published by ASUS as of the advisory date.

A local user with limited privileges can exploit this vulnerability to perform unauthorized file operations by bypassing path restrictions in the Aura Wallpaper Service. This could lead to modification, deletion, or creation of files outside intended directories. Furthermore, on certain ASUS models, exploitation may disable a specific feature of the service, potentially impacting usability or functionality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor ASUS advisories for updates. Until a fix is available, restricting local user access to the Aura Wallpaper Service and limiting local privilege escalation opportunities may reduce risk.