CVE-2026-1880

CVE-2026-1880 is a privilege escalation vulnerability in the ASUS DriverHub update process caused by incorrect permission assignment on critical resources. The flaw allows unprivileged local users to modify protected execution resources during the validation phase, enabling altered resources to bypass system checks and execute with elevated privileges when a user initiates an update. The vulnerability presents a local attack vector with moderate severity, requiring user interaction to trigger exploitation through an update action. The lack of proper protection mechanisms during the validation phase permits unauthorized modifications to critical resources before elevated execution occurs, creating a clear path to privilege escalation for local attackers. Exploitation status indicates minimal current activity, with an EPSS score of 0.000060 suggesting very low real-world exploitation likelihood at this time. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog and receives no significant community attention, though it remains catalogued as a legitimate security concern requiring remediation through the ASUS security update process.