{"id":"CVE-2026-122113","kind":"vulnerability","aliases":["CVE-2026-122113"],"related":[],"title":"Realtek USB audio driver: crafted USB device crashes Windows during enumeration","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required.","summary":"Realtek's RtUsbA64.sys USB audio driver recurses without limit when parsing a crafted USB device's topology descriptor during enumeration. The kernel stack is exhausted, so the system crashes (bugcheck), which is a denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","realtek","usb-audio","windows"],"not_affected_if":["no-physical-usb-access","no-realtek-usb-audio-driver"],"how_to_check":"- Check whether the machine has the Realtek USB audio driver: look for `RtUsbA64.sys` in `C:\\Windows\\System32\\drivers\\`","fix":null,"status":"open","published_at":"2026-11-06T19:17:43+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:46:16+00:00","updated_at":"2026-11-06T19:46:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T19:46:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Realtek USB audio driver: crafted USB device crashes Windows during enumeration","impact":"low","summary":"Realtek's RtUsbA64.sys USB audio driver recurses without limit when parsing a crafted USB device's topology descriptor during enumeration. The kernel stack is exhausted, so the system crashes (bugcheck), which is a denial of service.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","realtek","usb-audio"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Denial of service: the system crashes with a bugcheck on device enumeration","analyst_note":"Find the affected RtUsbA64.sys driver versions and the vendor fix from Realtek or NVD, since the sources give neither.","how_to_check":"- Check whether the machine has the Realtek USB audio driver: look for `RtUsbA64.sys` in `C:\\Windows\\System32\\drivers\\`\n- unknown for the affected driver versions and fixed version; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-realtek-usb-audio-driver","no-physical-usb-access"],"who_is_affected":"Systems with Realtek's RtUsbA64.sys USB audio driver loaded are exposed, and the attack needs physical access to plug in a malicious USB device. The sources do not name the affected driver versions or products. Systems without this driver, or with no physical access exposure, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000716,"input_tokens":4259,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122113':14A,17A '-2026':13A,16A 'allow':69C 'attack':73C 'audio':3A,22B,28B,67C 'authent':116C 'bugcheck':53B,108C 'caus':104C 'craft':5A,36B,77C,97C 'crash':8A,52B,107C 'cve':12A,15A 'denial':57B,112C 'descriptor':41B,98C 'devic':7A,38B,79C,93C 'driver':4A,29B,68C,86C 'enumer':11A,43B,94C 'exhaust':48B,99C 'infrastructur':18B 'kernel':45B,101C 'limit':32B 'logic':91C 'malici':76C 'pars':34B,90C 'physic':71C 'present':72C 'process':95C 'realtek':1A,19B,24B,63C 'recurs':30B,83C 'requir':120C 'result':109C 'rtusba64.sys':26B,65C 'servic':59B,114C 'session':118C 'stack':46B,102C 'system':51B,106C 'topolog':40B,89C 'topology-pars':88C 'trigger':81C 'unbound':82C 'usb':2A,6A,21B,27B,37B,66C,78C 'usb-audio':20B 'use':74C 'user':117C 'vulner':61C 'window':9A,23B 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Systems with Realtek's RtUsbA64.sys USB audio driver loaded are exposed, and the attack needs physical access to plug in a malicious USB device. The sources do not name the affected driver versions or products. Systems without this driver, or with no physical access exposure, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","low","realtek","usbaudio","windows"],"campaign_type":null,"search_a":"'-122113':14A,17A '-2026':13A,16A 'audio':3A 'craft':5A 'crash':8A 'cve':12A,15A 'devic':7A 'driver':4A 'enumer':11A 'realtek':1A 'usb':2A,6A 'window':9A","search_b":"'audio':22B,28B 'bugcheck':53B 'craft':36B 'crash':52B 'denial':57B 'descriptor':41B 'devic':38B 'driver':29B 'enumer':43B 'exhaust':48B 'infrastructur':18B 'kernel':45B 'limit':32B 'pars':34B 'realtek':19B,24B 'recurs':30B 'rtusba64.sys':26B 'servic':59B 'stack':46B 'system':51B 'topolog':40B 'usb':21B,27B,37B 'usb-audio':20B 'window':23B 'without':31B","search_c":"'allow':69C 'attack':73C 'audio':67C 'authent':116C 'bugcheck':108C 'caus':104C 'craft':77C,97C 'crash':107C 'denial':112C 'descriptor':98C 'devic':79C,93C 'driver':68C,86C 'enumer':94C 'exhaust':99C 'kernel':101C 'logic':91C 'malici':76C 'pars':90C 'physic':71C 'present':72C 'process':95C 'realtek':63C 'recurs':83C 'requir':120C 'result':109C 'rtusba64.sys':65C 'servic':114C 'session':118C 'stack':102C 'system':106C 'topolog':89C 'topology-pars':88C 'trigger':81C 'unbound':82C 'usb':66C,78C 'use':74C 'user':117C 'vulner':61C","first_public_at":"2026-11-06T19:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122113","severity":null,"published_at":"2026-11-06T19:17:43+00:00","modified_at":"2026-11-06T19:17:43+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}