{"id":"CVE-2026-90975","aliases":["EUVD-2026-118416","GHSA-xpr9-5x5h-5rvp"],"status":"published","title":"CVE-2026-90975","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00144,"percentile":0.03754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-822"],"published":"2026-11-06T18:36:42Z","modified":"2026-11-10T18:23:05Z","products":[{"vendor":"realtek","product":"rtusba64.sys"}],"references":[{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975"},{"url":"https://www.kb.cert.org/vuls/id/701544"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975"},{"url":"https://github.com/advisories/GHSA-xpr9-5x5h-5rvp"}],"sources":{"cve":[{"id":"CVE-2026-90975","title":"CVE-2026-90975","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","status":"published","published":"2026-11-06T18:36:42.089Z","modified":"2026-11-10T18:23:05.208Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-822"],"updated_at":"2026-11-10T19:39:59.74912Z"}],"euvd":[{"id":"EUVD-2026-118416","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","status":"published","published":"2026-11-06T18:36:42Z","modified":"2026-11-10T18:23:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T19:22:08.122585Z"}],"ghsa":[{"id":"GHSA-xpr9-5x5h-5rvp","title":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to...","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","status":"published","published":"2026-11-06T21:31:28Z","modified":"2026-11-10T21:31:55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-822"],"updated_at":"2026-11-10T21:57:47.623655Z"}],"nvd":[{"id":"CVE-2026-90975","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","status":"published","published":"2026-11-06T19:17:59.147Z","modified":"2026-11-12T20:04:52.377Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-822"],"updated_at":"2026-11-10T22:21:31.83577Z"}]}}