PT-2026-58876 · Asus · Gamesdk

CVE-2026-8919 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ASUS GameSDK (affected versions not specified)

Description A permissive Cross-domain Security Policy with untrusted domains allows a remote user to obtain a local user’s NTLM hash. This occurs when a user is convinced to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This issue can lead to information disclosure, data tampering, service unavailability for GameSDK, or unauthorized access to the victim’s information on other services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-8919

Affected Products

Gamesdk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-8919 · Security Note
• https://twitter.com/VulmonFeeds/status/2077303346277363959 · Twitter Post
• https://twitter.com/infoflowcloud/status/2077364263941788096 · Twitter Post
• https://asus.com/security-advisory · Note
• https://twitter.com/CVEnew/status/2077362475402448941 · Twitter Post