Realtek

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 9.8CriticalMay 1, 2015Realtek SDKCVE-2014-8361Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.Added to KEV Sep 18, 2023 · 3,062 days after publicationExploited100% likelyExploit codeExploit-DB · MetasploitDetection
• 9.8CriticalAug 16, 2021Realtek Jungle Software Development Kit (SDK) Code / command injectionCVE-2021-35394RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.Added to KEV Dec 10, 2021 · 116 days after publicationExploited100% likelyExploit codeNucleiDetection
• 9.8CriticalAug 16, 2021Realtek AP-Router SDK Memory corruptionCVE-2021-35395Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).Added to KEV Nov 3, 2021 · 79 days after publicationExploited98% likelyExploit codeNucleiDetection

Recent

• –UnscoredNov 6, 2026Realtek RtUsbA64.sys Memory corruptionCVE-2026-90975A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.
• –UnscoredNov 6, 2026Realtek RtUsbA64.sys Denial of serviceCVE-2026-122113A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required.
• 7.2HighJul 8, 2024Realtek rtl819x jungle software development kit Memory corruptionCVE-2023-41251A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.1.3% likely
• 9.8CriticalMay 1, 2015Realtek SDKCVE-2014-8361Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.Exploited100% likelyExploit codeExploit-DB · MetasploitDetection
• 9.8CriticalAug 16, 2021Realtek Jungle Software Development Kit (SDK) Code / command injectionCVE-2021-35394RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.Exploited100% likelyExploit codeNucleiDetection
• 9.8CriticalAug 16, 2021Realtek AP-Router SDK Memory corruptionCVE-2021-35395Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).Exploited98% likelyExploit codeNucleiDetection
• 7.8HighNov 2, 2021Realtek rtsupx usb utility driver Code / command injectionCVE-2021-36925RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a c
• 7.8HighNov 2, 2021Realtek rtsupx usb utility driver Code / command injectionCVE-2021-36924RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device.
• 7.8HighNov 2, 2021Realtek rtsupx usb utility driver Code / command injectionCVE-2021-36923RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure)
• 7.8HighNov 2, 2021Realtek rtsupx usb utility driver Code / command injectionCVE-2021-36922RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a

See every Realtek entry on the dashboard.

Top products

• RtUsbA64.sys2 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CERT/CC · Oct 26, 2026VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor IsolationCVE-2026-90975