CVE-2026-8919: High severity ASUS ASUS GameSDK vulnerability
Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim’s information on other services. Refer to the ' Security Update for ASUS GameSDK ' section on the ASUS Security Advisory for more information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8919?
CVE-2026-8919 has a high severity rating of 7.2 on the CVSS scale.
How do I fix CVE-2026-8919?
To fix CVE-2026-8919, update the ASUS GameSDK software to the latest version provided by ASUS.
What risk does CVE-2026-8919 pose?
The risk associated with CVE-2026-8919 is categorized as moderate with a risk score of 57.
What does CVE-2026-8919 exploit?
CVE-2026-8919 exploits a permissive cross-domain security policy which allows an attacker to obtain a local user's NTLM hash.
Who is affected by CVE-2026-8919?
CVE-2026-8919 affects users of the ASUS GameSDK software.