Read the docs
TI-2026-86069 Aliases CVE-2026-122113GHSA-243x-4g43-9fcq

Unbounded recursion in Realtek RtUsbA64.sys USB audio driver

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

A physically present attacker who connects a maliciously crafted USB device can trigger unbounded recursion in the topology-parsing logic of Realtek's RtUsbA64.sys USB audio driver during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), which results in denial of service. No authenticated user session is required. The listed affected version is 6.3.9600.2393.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required.

Why it matters now

EPSS 0.00155 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RealtekRtUsbA64.sys6.3.9600.2393—No fix listedCNA
  • RtUsbA64.sys VendorRealtek Affected 6.3.9600.2393 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for RtUsbA64.sys.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-122113
  2. 2026-11-06 Alias added: GHSA-243x-4g43-9fcq

References

Other 1

  • TI-2021-14193 Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14192 Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-06873 The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14191 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server… CVSS 3.1CRITICAL 9.8
  • TI-2023-25815 Cross-site request forgery in LevelOne WBR-6013 CVSS 3.1HIGH 8.8
  • TI-2021-14190 Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server… CVSS 3.1HIGH 7.5
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences