{"id":"CVE-2026-90975","kind":"vulnerability","aliases":["CVE-2026-90975"],"related":[],"title":"Realtek USB audio driver flaw lets local users gain kernel access","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","summary":"Realtek's RtUsbA64.sys USB audio driver exposes a kernel IOCTL interface that trusts a user-mode pointer supplied by the caller. A low-privileged local user can send crafted property requests to gain kernel-mode read and write access, enabling privilege escalation and arbitrary kernel code execution.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RtUsbA64.sys","fixed":[],"affected":"6.3.9600.2393 (per OpenCVE; vendor range unconfirmed)","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoints","infrastructure","realtek","usb-audio","windows"],"not_affected_if":["no-realtek-usb-audio-driver"],"how_to_check":"Check the file version of C:\\Windows\\System32\\drivers\\RtUsbA64.sys (right-click > Properties > Details, or PowerShell: (Get-Item C:\\Windows\\System32\\drivers\\RtUsbA64.sys).VersionInfo.FileVersion). OpenCVE lists 6.3.9600.2393 as affected; no vendor-confirmed range yet. Also check DriverStore for older copies: pnputil /enum-drivers.","fix":null,"status":"open","published_at":"2026-11-06T19:17:59+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","triaged_at":"2026-11-06T19:46:01+00:00","updated_at":"2026-11-06T19:47:08+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-06T19:46:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Realtek USB audio driver flaw lets local users gain kernel access","impact":"high","summary":"Realtek's RtUsbA64.sys USB audio driver exposes a kernel IOCTL interface that trusts a user-mode pointer supplied by the caller. A low-privileged local user can send crafted property requests to gain kernel-mode read and write access, enabling privilege escalation and arbitrary kernel code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","realtek","usb-audio","endpoints"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel code execution and full system control","analyst_note":"Find affected RtUsbA64.sys versions and Realtek's fixed driver release; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-90975 and Realtek's advisories.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-realtek-usb-audio-driver"],"who_is_affected":"Systems with the Realtek RtUsbA64.sys USB audio driver installed are exposed, and the attacker must already have a local low-privileged account. The sources do not list affected driver versions or Windows builds, so unknown. Systems without this Realtek driver can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4275,"output_tokens":534,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected RtUsbA64.sys versions and Realtek's fixed driver release; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-90975 and Realtek's advisories.","search":"'-2026':13A,16A '-90975':14A,17A 'abus':93C 'access':11A,67B,131C 'act':101C 'allow':85C 'arbitrari':72B,141C 'attack':122C 'audio':3A,24B,30B,83C 'caller':47B,105C 'caller-suppli':104C 'captur':115C 'code':74B,143C 'control':97C 'craft':56B,118C 'cve':12A,15A 'driver':4A,31B,84C 'enabl':68B 'endpoint':19B 'escal':70B,139C 'execut':75B,144C 'expos':32B 'flaw':5A 'gain':9A,60B 'i/o':96C 'infrastructur':20B 'interfac':36B,99C 'ioctl':35B,98C 'issu':117C 'kernel':10A,34B,62B,73B,95C,126C,142C 'kernel-mod':61B,125C 'let':6A 'leverag':135C 'local':7A,52B,87C,137C 'low':50B,89C 'low-privileg':49B,88C 'mode':42B,63B,109C,127C 'obtain':124C 'pointer':43B,110C 'privileg':51B,69B,90C,138C 'proper':112C 'properti':57B,119C 'read':64B,128C 'realtek':1A,21B,26B,79C 'request':58B,120C 'rtusba64.sys':18A,28B,81C 'send':55B 'suppli':44B,106C 'trust':38B 'usb':2A,23B,29B,82C 'usb-audio':22B 'user':8A,41B,53B,91C,108C 'user-mod':40B,107C 'valid':113C 'vulner':77C 'window':25B 'without':111C 'write':66B,130C","nicknames":[],"mitigations":[],"who_affected":"Systems with the Realtek RtUsbA64.sys USB audio driver installed are exposed, and the attacker must already have a local low-privileged account. The sources do not list affected driver versions or Windows builds, so unknown. Systems without this Realtek driver can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["rtusba64sys"],"ptokens":["rtusba64","sys"],"labels":["endpoints","high","infrastructure","realtek","usbaudio","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-90975':14A,17A 'access':11A 'audio':3A 'cve':12A,15A 'driver':4A 'flaw':5A 'gain':9A 'kernel':10A 'let':6A 'local':7A 'realtek':1A 'rtusba64.sys':18A 'usb':2A 'user':8A","search_b":"'access':67B 'arbitrari':72B 'audio':24B,30B 'caller':47B 'code':74B 'craft':56B 'driver':31B 'enabl':68B 'endpoint':19B 'escal':70B 'execut':75B 'expos':32B 'gain':60B 'infrastructur':20B 'interfac':36B 'ioctl':35B 'kernel':34B,62B,73B 'kernel-mod':61B 'local':52B 'low':50B 'low-privileg':49B 'mode':42B,63B 'pointer':43B 'privileg':51B,69B 'properti':57B 'read':64B 'realtek':21B,26B 'request':58B 'rtusba64.sys':28B 'send':55B 'suppli':44B 'trust':38B 'usb':23B,29B 'usb-audio':22B 'user':41B,53B 'user-mod':40B 'window':25B 'write':66B","search_c":"'abus':93C 'access':131C 'act':101C 'allow':85C 'arbitrari':141C 'attack':122C 'audio':83C 'caller':105C 'caller-suppli':104C 'captur':115C 'code':143C 'control':97C 'craft':118C 'driver':84C 'escal':139C 'execut':144C 'i/o':96C 'interfac':99C 'ioctl':98C 'issu':117C 'kernel':95C,126C,142C 'kernel-mod':125C 'leverag':135C 'local':87C,137C 'low':89C 'low-privileg':88C 'mode':109C,127C 'obtain':124C 'pointer':110C 'privileg':90C,138C 'proper':112C 'properti':119C 'read':128C 'realtek':79C 'request':120C 'rtusba64.sys':81C 'suppli':106C 'usb':82C 'user':91C,108C 'user-mod':107C 'valid':113C 'vulner':77C 'without':111C 'write':130C","first_public_at":"2026-11-06T19:17:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975","severity":null,"published_at":"2026-11-06T19:17:59+00:00","modified_at":"2026-11-06T19:17:59+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-90975:1922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975","severity":null,"published_at":"2026-11-06T19:47:08+00:00","modified_at":"2026-11-06T19:47:08+00:00","first_seen_at":"2026-11-06T19:47:08+00:00","fetched_at":"2026-11-06T19:47:08+00:00","note":"No Realtek advisory found; only NVD (page returned empty) and OpenCVE, which lists RtUsbA64.sys 6.3.9600.2393 as affected. No fixed version, no PoC, no exploitation reports found. Nothing verified. Settle by: Realtek security advisory or OEM (Dell/HP/Lenovo) driver notes.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-90975","https://app.opencve.io/cve/CVE-2026-90975"]}],"documents":[{"id":89371,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975","title":"NVD CVE-2026-90975","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":89370,"url":"https://app.opencve.io/cve/CVE-2026-90975","title":"CVE-2026-90975 - OpenCVE","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}