CVE-2026-90890

MediumCVSS 5.5

Published: 14/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 14/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

The ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. An authenticated local attacker can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

Risk Assessment

A local attacker with user-level access can cause an operating system crash (BSOD), leading to disruption and potential data loss. The risk applies to workstations with ASRock Polychrome SYNC/RGB installed.

Recommendation

Update the ASRock Polychrome SYNC/RGB software to a version containing the fix. Restrict local access to machines with this software to trusted users.

Other vulnerabilities in ASRock Polychrome SYNC/RGB

CVE-2026-90891Medium
The ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. An authenticated local attacker can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboot.

Original NVD description (English source)

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS