Medium severity · published Mar 28, 2025
CVE-2025-2027
A double free vulnerability has been identified in the ASUS System Analysis service
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances.
Refer to the 'Security Update for MyASUS' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASCI · ASUS
before 1.1.32.0; before 3.1.43.0; before 3.2.44.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2027
www.asus.com
https://www.asus.com/content/asus-product-security-advisory/
More from ASCI
7.8
CVE-2025-12793
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent
5.3
CVE-2024-55408
An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied