CVE-2026-18023: asus armoury crate

Vulnerability summary

CVE-2026-18023 is a medium (CVSS 5.7) vulnerability in asus armoury crate. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.4% of scored vulnerabilities.

Timeline

1. 08-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

• CWE-226Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.