Medium severity · published Dec 17, 2025
CVE-2025-11775
An out-of-bounds read vulnerability has been identified in the asComSvc service
4.8
CVSS
0.1%
EPSS
No
On KEV
Description
An out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crafted requests, which may lead to a service crash or partial loss of functionality. This vulnerability only affects ASUS motherboard series products. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Armoury Crate · ASUS
v6.3.4 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11775
www.asus.com
https://www.asus.com/security-advisory
More from Armoury Crate
9.8
CVE-2023-5716
ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission
8.5
CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link…
8.5
CVE-2025-9968
A link following vulnerability exists in the UnifyScanner component of Armoury Crate
8.4
CVE-2025-3464
A race condition vulnerability exists in Armoury Crate
8.4
CVE-2024-12957
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion