Read the docs
TI-2026-86066 Aliases CVE-2026-90975GHSA-xpr9-5x5h-5rvp

Realtek RtUsbA64.sys flaw allows local privilege escalation

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

Realtek RtUsbA64.sys, the USB audio driver, is affected in version 6.3.9600.2393. A kernel I/O control interface acts on a caller-supplied user-mode pointer without proper validation or capture. A local user with low privileges can issue crafted property requests to gain kernel-mode read and write access, which enables local privilege escalation and arbitrary kernel code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.

Why it matters now

EPSS 0.00185 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RealtekRtUsbA64.sys6.3.9600.2393—No fix listedCNA
  • RtUsbA64.sys VendorRealtek Affected 6.3.9600.2393 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Realtek RtUsbA64.sys.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-90975
  2. 2026-11-06 Alias added: GHSA-xpr9-5x5h-5rvp

References

Other 1

  • TI-2021-14193 Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14192 Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-06873 The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14191 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server… CVSS 3.1CRITICAL 9.8
  • TI-2023-25815 Cross-site request forgery in LevelOne WBR-6013 CVSS 3.1HIGH 8.8
  • TI-2021-14190 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server… CVSS 3.1HIGH 7.5
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences