CVE-2026-8070

HighCVSS 7.3

Published: 29/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.09%

1th percentile - higher than 1% of all known CVEs

Summary

A vulnerability in Armoury Crate software stems from incorrect permission assignment for a critical resource. A local user can bypass the driver's validation mechanism, gaining unauthorized read and write access to physical memory.

Risk Assessment

The risk involves potential privilege escalation by a local user, which could lead to system compromise, data theft, or malware installation.

Recommendation

It is recommended to immediately update Armoury Crate to the latest version as per the ASUS Security Advisory. Additionally, restrict local system access to trusted users only.

Other vulnerabilities in Armoury Crate

CVE-2026-16003Low
An exposed IOCTL with insufficient access control in the Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request, bypassing the driver's verification. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.

Original NVD description (English source)

Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, resulting in unauthorized read and write access to physical memory.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.