Loading story…
ASUS disclosed a high-severity vulnerability tracked as CVE-2026-8917 affecting multiple Windows utilities, including GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll. The flaw stems from an untrusted pointer dereference in an IOCTL handler that can let a local attacker write a specific value to an arbitrary memory address, creating a path to privilege escalation on affected systems.
The issue carries a CVSS 4.0 score of 8.4 and is classified under CWE-822. While the vulnerability is not remotely exploitable, national CERT notices and the CVE entry point users to ASUS security advisories and patched software versions as the primary mitigation, making updates a priority for organizations running the affected ASUS management and tuning tools.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT-PY published another notice concerning vulnerabilities in ASUS products. The reference shows a separate advisory publication tied to the same ASUS vulnerability story.
A CVE record was published for CVE-2026-8917, a high-severity arbitrary memory write vulnerability caused by an untrusted pointer dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll. The flaw can allow a local attacker to write a specific value to an arbitrary memory address and potentially escalate privileges.
CERT-PY published a notice about vulnerabilities affecting ASUS products. The reference indicates this was a distinct advisory publication related to the ASUS issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourcecvefeed.io
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos disclosed multiple high-severity vulnerabilities in the `AsIO3.sys` kernel driver used by **ASUS Armoury Crate** and related utilities, including an authorization bypass tracked as **CVE-2025-3464**. The bypass affects Armoury Crate versions `5.9.9.0` through `6.1.18.0` and lets a low-privileged authenticated attacker abuse a race condition and a specially crafted hard link to defeat the driver’s SHA-256-based validation of `AsusCertService.exe`, obtain access to the `\Device\Asusgio3` device, and escalate privileges to **SYSTEM**. Talos said the exposed device functionality includes physical memory mapping, I/O port access, and MSR register access, creating a path to full system compromise. Talos also reported a separate stack-based buffer overflow in the same driver family, affecting **Armoury Crate 5.9.13.0**, **AI Suite 3 1.0.0.0**, and **AsIO3 Driver 1.02.30**, where a path-conversion routine copies an application image path into a fixed-size stack buffer without proper length checks. A specially crafted long path can trigger stack corruption during handle acquisition for the Asusgio3 device, and Talos confirmed the condition with a `DRIVER_OVERRAN_STACK_BUFFER` bugcheck. ASUS has released patches for the issues and urged users and administrators to update affected software immediately.
Jul 24, 2026
ASUS disclosed **CVE-2026-13585**, a high-severity flaw affecting **ASUS System Control Interface v3**, **ASUS System Control Interface**, and **ASUS Business Manager**. The vulnerability stems from improper handling of driver resources, including allocation without limits and failure to clear sensitive data before reuse, allowing a **local administrator** to use crafted **IOCTL** requests to disclose sensitive information. In severe cases, the issue can also trigger a **denial of service** on the affected host, according to the CVE record and ASUS advisory. Public discussion identified the affected kernel driver as **`bsitf.sys` / `AsusBSItf.sys`** and described the bug as an **arbitrary physical memory mapping** issue tied to unvalidated IOCTL handling. Posts circulating in security and administrator forums said a technical write-up and proof of concept had been published, increasing visibility into the flaw and its potential abuse as a local kernel-level security risk on ASUS business systems. ASUS has published remediation guidance and countermeasures for impacted products.
Jul 21, 2026
ASUS patched two vulnerabilities in its preinstalled **DriverHub** software that can be chained to achieve unauthenticated remote code execution on affected Windows systems. The flaws, tracked as `CVE-2025-3462` and `CVE-2025-3463`, affect DriverHub versions earlier than **1.0.6.0** and stem from insufficient certificate and origin validation in the utility’s update and installation workflow. Researchers reported that the bugs allow a malicious website to interact with DriverHub through specially crafted HTTP requests and trigger code execution with minimal user interaction. According to public reporting and ASUS’s security advisory, the attack abuses a `driverhub.asus.com.<arbitrary>.com`-style domain to pass validation checks, causing DriverHub to launch `AsusSetup.exe` in silent mode and process a malicious `AsusSetup.ini` file that redirects installation to attacker-controlled code. CSIRT.SK said successful exploitation could fully compromise the confidentiality, integrity, and availability of a victim machine. ASUS has released updates and urged users to upgrade DriverHub immediately to version **1.0.6.0** or later.
Jul 24, 2026