CVE-2026-90975: Security vulnerability

Published Nov 6, 2026

Updated

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:36 PM

Data Sourced

via MITRE·06:36 PM

DescriptionWeakness

Data Sourced

via NVD·07:17 PM

Description

Frequently Asked Questions

Can this be exploited remotely?

The issue is described as local: an attacker must already be able to run as a low-privileged user on the affected system.

What does an attacker need to do to exploit it?

They need to issue crafted property requests through the driver's kernel I/O control interface, supplying a user-mode pointer that is not properly validated or captured.

What could successful exploitation allow?

Successful exploitation can provide kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.

CVE-2026-90975: Security vulnerability

Event History

Frequently Asked Questions

Can this be exploited remotely?

What does an attacker need to do to exploit it?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Can this be exploited remotely?

What does an attacker need to do to exploit it?

What could successful exploitation allow?