Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ASUS

Description

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On specific models , this can also cause a single feature to become unavailable . Refer to the ' Security Update for Aura Wallpaper Service ' section on the ASUS Security Advisory for more information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ASUS Aura Wallpaper Service

Default version status: unaffected

  • v2.1.8.0 to ≤ v2.1.15.0affected

References