CVE-2026-8920CWE-73CWE-923

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to…

High · published July 15, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On specific models , this can also cause a single feature to become unavailable .

Refer to the ' Security Update for Aura Wallpaper Service ' section on the ASUS Security Advisory for more information.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
EPSS
0.00112 · 1.3th percentile
Weaknesses
CWE-73 · External Control of File Name or Path; CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints
Published
2026-07-15T02:00Z
EPSS history
Timeline
  • 15 JUL 02:00Z
    Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to…
    cvelistv5