---
id: "CVE-2026-112116"
kind: "vulnerability"
aliases: ["CVE-2026-112116"]
title: "ASUS System Control Interface: local user can read and write physical memory"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["asus", "asus-system-control-interface", "consumer-pc", "driver", "infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["component-not-installed", "non-asus-hardware"]
published_at: "2026-11-04T02:17:14+00:00"
first_seen_at: "2026-11-04T02:46:01+00:00"
updated_at: "2026-11-04T02:49:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112116", "first_seen_at": "2026-11-04T02:46:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T02:49:46+00:00"}]
---

# ASUS System Control Interface: local user can read and write physical memory

ASUS System Control Interface exposes a device control request (IOCTL) without enough access control. A local user with low privileges can read and write arbitrary physical memory, which can lead to full control of the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether ASUS System Control Interface (ASCI, v1 or v3; preinstalled with MyASUS on ASUS PCs) is installed on Windows machines. The installed version shows in MyASUS under Settings > About, or in Apps > Installed apps.
- Fixed version for this CVE: unknown. Compare against the 'Security Update for ASUS System Control Interface' section at https://www.asus.com/security-advisory.
- Also check: related CVE-2026-15029/15030 (admin-only) list ASCI v3 before 3.1.65.0 and v1 before 1.1.40.0 as affected. Updating to at least those is a reasonable step, but not confirmed as the fix for this CVE.

## Timeline

- 2026-11-04T02:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112116
- 2026-11-04T02:49:46+00:00 analyst — Could not read the ASUS advisory entry for this CVE: asus.com advisory pages are JS-rendered or cached from 2025, and NVD/CVE.org returned no version data. Fixed version and affected range remain unknown. Sibling CVE-2026-15029/15030 (admin-only, same component, different CVE) list v3 before 3.1.65.0 and v1 before 1.1.40.0, but that is not confirmed for this CVE. Nothing verified. X not checked. Next: read the 'Security Update for ASUS System Control Interface' section at asus.com/security-advisory.

## Documents

- [describes] NVD CVE-2026-112116 https://nvd.nist.gov/vuln/detail/CVE-2026-112116

## From the sources

An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.
Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_