VulnerabilityDeferred

CVE-2025-2027

A double free vulnerability has been identified in the ASUS System Analysis service.

MEDIUM 5.9EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending specially crafted local RPC requests, leading to the service crash and potentially memory manipulation in some rare circumstances. Refer to the 'Security Update for MyASUS' section on the ASUS Security Advisory for more information.

CVSS 4.0: 5.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-415
Source: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

References

https://www.asus.com/content/asus-product-security-advisory/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.