ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping in ASUS Business/Software Manager kernel driver

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-21 05:41 UTC
Importiert: 2026-07-23 03:15 UTC
CVSS: 8.2
Quelle-ID: full_disc
uid_hash: 154f50a9ef849b820ee9771b097bd19cec2dd837e637ae77e9dfba51a0fa905f

Full Disclosure

Posted by Hayaturehman Ahmadzai on Jul 20 Hi all,

I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys /

AsusBSItf.sys kernel driver, shipped with ASUS Business Manager and

Software Manager. ASUS has assigned the CVE and published a vendor advisory

with countermeasures.

Summary: The driver exposes a device (\.\bsitf, admin-required to open)

with an IOCTL that allocates a caller-specified amount of physically

contiguous kernel memory, maps it into the calling...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-13585	HIGH	8.2	HIGH	8.2			2026-07-15

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss