CVE-2026-90890 Details
Description
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.
A vulnerability allowing untrusted pointer dereference has been identified in the ASRock Polychrome SYNC/RGB software utility, affecting both motherboard and VGA versions. This vulnerability allows authenticated local attackers to send specially crafted IOCTL requests that cause the driver to dereference an unvalidated pointer, leading to a crash of the operating system.
Users are advised to update ASRock Polychrome SYNC/RGB for Motherboard to a version later than 1.0.118 and ASRock Polychrome SYNC/RGB for VGA to a version later than 2.0.219.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.twcert.org.tw/en/cp-139-11204-6b1c6-2.html | [email protected] | AdvisoryBundleRemedy |
| https://www.twcert.org.tw/tw/cp-132-11205-f6677-1.html | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-822 | Untrusted Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ASRock Polychrome SYNC | <= 1.0.118 (semver) <= 2.0.219 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |