CVE-2026-8920 Details
Description
Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On specific models , this can also cause a single feature to become unavailable . Refer to the ' Security Update for Aura Wallpaper Service ' section on the ASUS Security Advisory for more information.
A vulnerability in the Aura Wallpaper Service allows local users to bypass path restrictions and perform unauthorized file operations by sending commands with arbitrary file paths. On certain models, this could also disable a specific feature. The issue affects versions through 2.1.15.0.
Users can refer to the 'Security Update for Aura Wallpaper Service' section on the ASUS Security Advisory for update instructions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.asus.com/security-advisory/ | ASUS | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | ASUS |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | ASUS |
Affected Products
| Product | Versions |
|---|---|
| ASUS Aura Wallpaper Service | <= 2.1.15.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | ASUS |