CVE-2026-88781
Received
Received - Intake
Untrusted Pointer Dereference in ASUS Motherboard Firmware
Vulnerability report for CVE-2026-88781, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-27
Last updated on: 2026-10-27
Assigner: ASUS
Description
Description
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash.
Refer to the 'Security Update for Multiple ASUS Motherboards' section on the ASUS Security Advisory for more information.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ASUS | motherboards firmware | A520/B550 series Before 3644 4304 |
| ASUS | motherboards firmware | X570 Series Before 5054 |
| ASUS | motherboards firmware | A620/A620A Series Before 4003 4004 |
| ASUS | motherboards firmware | B650 Series Before 1303 4003 4004 |
| ASUS | motherboards firmware | X670 Series Before 4003 4004 |
| ASUS | motherboards firmware | B840 Series Before 1804 |
| ASUS | motherboards firmware | B850 Series Before 1103 1804 2503 |
| ASUS | motherboards firmware | X870 Series Before 1804 2503 |
| ASUS | motherboards firmware | X870E Series Before 1103 2503 |
| ASUS | motherboards firmware | Knoll Series Before 4003 |
| ASUS | motherboards firmware | TRX50 Series Before 0703 1403 |
| ASUS | motherboards firmware | W790 Series Before 2101 |
| ASUS | motherboards firmware | WRX90 Series Before 1403 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-822 | The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. |
