Medium severity · published May 8, 2026
CVE-2026-3508
An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer…
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer size.Refer to the '
Security Update for MyASUS ' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASUS System Control Interface · ASUS
through V3.1.59.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3508
www.asus.com
https://www.asus.com/security-advisory
More from ASUS System Control Interface
7.3
CVE-2026-7480
An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary…