Read the docs
TI-2025-07597 Aliases CVE-2025-8301GHSA-6rm9-4q77-v87p

Heap-based buffer overflow in Realtek RTL8811AU

Priority LOW 35CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24786.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RealtekRTL8811AU1030.38.712.2019—No fix listedCNA
  • RTL8811AU VendorRealtek Affected 1030.38.712.2019 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:realtek:wi-fi_usb_driver:*:*:*:*:*:windows:*:*before 1030.52.0325.2025VulnerableRealtek
cpe:2.3:h:realtek:rtl8811au:-:*:*:*:*:*:*:*not specified by NVDRunning onRealtek
  • cpe:2.3:a:realtek:wi-fi_usb_driver:*:*:*:*:*:windows:*:* Versions before 1030.52.0325.2025 Vulnerable ·Realtek
  • cpe:2.3:h:realtek:rtl8811au:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Realtek

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8301
  2. 2026-10-03 Alias added: GHSA-6rm9-4q77-v87p

References

Advisory 1

  • TI-2025-07598 Heap-based buffer overflow in Realtek rtl81xx SDK CVSS 3.0HIGH 8.8
  • TI-2025-07596 Heap-based buffer overflow in Realtek rtl81xx SDK CVSS 3.0HIGH 8.8
  • TI-2025-07595 Heap-based buffer overflow in Realtek rtl81xx SDK CVSS 3.0HIGH 8.8
  • TI-2025-07594 Out-of-bounds read in Realtek RTL8811AU CVSS 3.0LOW 3.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences