ASRock vulnerabilities

Products

• a-tuning 4
• f-stream 4
• restart to uefi 4
• rgbled 4
• ASRock Polychrome SYNC/RGB for MB 2
• ASRock Polychrome SYNC/RGB for VGA 2
• box-r1000 firmware 1
• Intel 500 chipset motherboard 1
• Intel 600 chipset motherboard 1
• Intel 700 chipset motherboard 1
• Intel 800 chipset motherboard 1
• rgb driver firmware 1

Latest ASRock CVEs

Newest publication first

1. CVE-2026-90891 ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control

   Published 2026-09-14

   Medium·CVSS 6.8 EPSS 0.13%

   ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced opera...

2. CVE-2026-90890 ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference

   Published 2026-09-14

   Medium·CVSS 6.8 EPSS 0.14%

   ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating s...

3. CVE-2025-14304 ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure

   Published 2025-12-17

   High·CVSS 7.0 EPSS 0.35%

   Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd. has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrar...

4. CVE-2020-14032 ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.

   Published 2021-07-23

   Critical·CVSS 9.8 EPSS 2.1%

   ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM.

5. CVE-2020-15368 AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.

   Published 2020-06-29

   Medium·CVSS 5.5 EPSS 1.3%

   AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.

6. CVE-2018-10709 The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to r...

   Published 2018-10-30

   High·CVSS 7.8 EPSS 1.2% PoC

   The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write CR register values. This could be leveraged in a number of ways to...

7. CVE-2018-10710 The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to r...

   Published 2018-10-30

   High·CVSS 7.1 EPSS 0.98% PoC

   The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local atta...

8. CVE-2018-10711 The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to r...

   Published 2018-10-30

   High·CVSS 7.8 EPSS 1.5% PoC

   The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write Machine Specific Registers (MSRs). This could be leveraged to exec...

9. CVE-2018-10712 The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to r...

   Published 2018-10-30

   High·CVSS 7.8 EPSS 1.3% PoC

   The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.