High severity · published Nov 6, 2025
CVE-2025-9338
A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver
7.3
CVSS
0.1%
EPSS
No
On KEV
Description
A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing a specially crafted process, potentially leading to local privilage escalation.
For additional information, please refer to the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Armoury Crate · ASUS
6.2.11 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9338
www.asus.com
https://www.asus.com/security-advisory/
More from Armoury Crate
9.8
CVE-2023-5716
ASUS Armoury Crate - Arbitrary File Write
8.5
CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link…
8.5
CVE-2025-9968
A link following vulnerability exists in the UnifyScanner component of Armoury Crate
8.4
CVE-2025-3464
A race condition vulnerability exists in Armoury Crate
8.4
CVE-2024-12957
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion