CVE-2026-90890
Received Received - Intake

ASRock Polychrome SYNC Untrusted Pointer Dereference

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: TWCERT/CC

Description
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90890
EUVD
EUVD-2026-77365

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
asrock polychrome_sync *
asrock polychrome_sync_rgb to 1.0.118 (exc)
asrock polychrome_sync_rgb to 2.0.219 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-822 The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90890 is an Untrusted Pointer Dereference vulnerability in ASRock Polychrome SYNC/RGB software utility. Authenticated local attackers can exploit this by sending a specially crafted IOCTL request to the driver, causing it to dereference an unvalidated pointer. This results in an operating system crash.

Detection Guidance

This vulnerability can be detected by checking the installed version of ASRock Polychrome SYNC/RGB software. If the version is 1.0.118 or earlier for MB or 2.0.219 or earlier for VGA, the system is vulnerable. Use commands like 'wmic product get name, version' on Windows or 'dpkg -l | grep polychrome' on Linux to check the installed version.

Impact Analysis

This vulnerability allows authenticated local attackers to crash the operating system by exploiting the driver. This can lead to denial of service, data loss, or system instability for users running affected versions of ASRock Polychrome SYNC/RGB software.

Mitigation Strategies

Immediately update ASRock Polychrome SYNC/RGB software to versions beyond 1.0.118 for MB and beyond 2.0.219 for VGA. Download the latest version from the official ASRock website and install it to patch the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart