CVE-2026-75811: CWE-1256 — Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate

This vulnerability (CWE-1256) in ASUS Armoury Crate allows a local attacker with low privileges to bypass driver authentication mechanisms and access critical model-specific registers (MSRs). By doing so, the attacker can modify hardware configuration settings, which may lead to hardware damage. The issue stems from improper restriction of software interfaces to hardware features. The CVSS v4.0 score is 5.8 (medium severity), reflecting the local attack vector with high impact on integrity and availability but requiring high attack complexity and privileges. The affected versions include all Armoury Crate versions through 6.5.7.

A local user with low privileges can bypass driver authentication to access critical hardware registers and modify hardware configuration settings. This can potentially cause hardware damage or instability. The vulnerability does not appear to be exploitable remotely and requires local access. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unauthorized attempts to access hardware configuration interfaces.