CVE-2026-8917

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8917", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "state": "PUBLISHED", "assignerShortName": "ASUS", "dateReserved": "2026-05-19T05:56:53.178Z", "datePublished": "2026-08-11T02:00:08.248Z", "dateUpdated": "2026-09-17T08:34:50.263Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2026-09-17T08:34:50.263Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-822", "description": "CWE-822: Untrusted Pointer Dereference", "type": "CWE"}]}], "affected": [{"vendor": "ASUS", "product": "GPU Tweak III", "versions": [{"status": "affected", "version": "through V2.1.1.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "GPUTweakII", "versions": [{"status": "affected", "version": "through V2.4.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "AI Suite3", "versions": [{"status": "affected", "version": "through V2.1.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "VGAdll", "versions": [{"status": "affected", "version": "through V0.0.7.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:asus:gpu_tweak_iii:through_v2.1.1.7:*:*:*:*:*:*:*"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:asus:gputweakii:through_v2.4.0.0:*:*:*:*:*:*:*"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:asus:ai_suite3:through_v2.1.2.0:*:*:*:*:*:*:*"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:asus:vgadll:through_v0.0.7.8:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.\nRefer to the '\u00a0\nSecurity Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin\u00a0\u00a0\u00a0' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.<br>Refer to the '&nbsp;\nSecurity Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin&nbsp;&nbsp;&nbsp;' section on the ASUS Security Advisory for more information."}]}], "references": [{"url": "https://www.asus.com/security-advisory"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Angelo Frasca Caccia", "type": "finder"}, {"lang": "en", "value": "SentinelOne", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T18:52:02.810606Z", "id": "CVE-2026-8917", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:52:19.454Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T18:52:02.810606Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:52:06.726Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Angelo Frasca Caccia"}, {"lang": "en", "type": "finder", "value": "SentinelOne"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "GPU Tweak III", "versions": [{"status": "affected", "version": "through V2.1.1.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "GPUTweakII", "versions": [{"status": "affected", "version": "through V2.4.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "AI Suite3", "versions": [{"status": "affected", "version": "through V2.1.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "VGAdll", "versions": [{"status": "affected", "version": "through V0.0.7.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.asus.com/security-advisory"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.\nRefer to the '\u00a0\nSecurity Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin\u00a0\u00a0\u00a0' section on the ASUS Security Advisory for more information.", "supportingMedia": [{"type": "text/html", "value": "Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.<br>Refer to the '&nbsp;\nSecurity Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin&nbsp;&nbsp;&nbsp;' section on the ASUS Security Advisory for more information.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-822", "description": "CWE-822: Untrusted Pointer Dereference"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:gpu_tweak_iii:through_v2.1.1.7:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:gputweakii:through_v2.4.0.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:ai_suite3:through_v2.1.2.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asus:vgadll:through_v0.0.7.8:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2026-09-17T08:34:50.263Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8917", "state": "PUBLISHED", "dateUpdated": "2026-09-17T08:34:50.263Z", "dateReserved": "2026-05-19T05:56:53.178Z", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "datePublished": "2026-08-11T02:00:08.248Z", "assignerShortName": "ASUS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GPU Tweak III", "vendor": "ASUS", "versions": [{"status": "affected", "version": "through V2.1.1.7", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "GPUTweakII", "vendor": "ASUS", "versions": [{"status": "affected", "version": "through V2.4.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "AI Suite3", "vendor": "ASUS", "versions": [{"status": "affected", "version": "through V2.1.2.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VGAdll", "vendor": "ASUS", "versions": [{"status": "affected", "version": "through V0.0.7.8", "versionType": "custom"}]}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.\nRefer to the '\u00a0\nSecurity Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin\u00a0\u00a0\u00a0' section on the ASUS Security Advisory for more information."}], "id": "CVE-2026-8917", "lastModified": "2026-09-17T09:16:42.690", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8917", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T18:52:02.810606Z", "version": "2.0.3"}}]}, "published": "2026-08-11T03:18:01.900", "references": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "url": "https://www.asus.com/security-advisory"}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-822"}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V2.1.2.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "AI Suite3", "source": "cna", "vendor": "ASUS"}, "product": "ai_suite3", "vendor": "asus"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V2.1.1.7]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GPU Tweak III", "source": "cna", "vendor": "ASUS"}, "product": "gpu_tweak_iii", "vendor": "asus"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V2.4.0.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GPUTweakII", "source": "cna", "vendor": "ASUS"}, "product": "gputweakii", "vendor": "asus"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V0.0.7.8]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "VGAdll", "source": "cna", "vendor": "ASUS"}, "product": "vgadll", "vendor": "asus"}], "created": "2026-08-11T03:30:03.273449+00:00", "title": "Untrusted Pointer Dereference in ASUS GPU Tweak and AI Suite Leading to Local Privilege Escalation", "updated": "2026-08-11T04:30:03.046918+00:00", "vendors": ["asus", "asus$PRODUCT$ai_suite3", "asus$PRODUCT$gpu_tweak_iii", "asus$PRODUCT$gputweakii", "asus$PRODUCT$vgadll"]}