Realtek
78 CVEs across 81 Realtek products. Browse Realtek vulnerabilities, severities, and proof-of-concept exploits.
Realtek products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37252 | High | 7.8 | 2026-06-19 | Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by i… |
CVE-2016-20085 | High | 7.8 | 2026-06-19 | Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a… |
CVE-2019-25345 | High | 7.8 | 2026-02-12 | Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Atta… |
CVE-2020-36974 | High | 7.8 | 2026-01-27 | Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated… |
CVE-2025-8302 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8301 | High | 7.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows lo… |
CVE-2025-8300 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2025-8299 | High | 8.8 | 2025-09-02 | Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows… |
CVE-2025-8298 | Low | 3.8 | 2025-09-02 | Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows loc… |
CVE-2025-44526 | Medium | 6.5 | 2025-07-09 | Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data p… |
CVE-2025-44531 | High | 7.5 | 2025-06-24 | An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is… |
CVE-2024-11857 | High | 7.8 | 2025-06-02 | Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as… |
CVE-2024-21778 | High | 7.2 | 2024-07-08 | A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK v3.4.11. A special… |
CVE-2023-50383 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50382 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50381 | High | 7.2 | 2024-07-08 | Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP req… |
CVE-2023-50330 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP r… |
CVE-2023-50244 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of H… |
CVE-2023-50243 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of H… |
CVE-2023-50240 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craft… |
CVE-2023-50239 | High | 7.2 | 2024-07-08 | Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craft… |
CVE-2023-49867 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP r… |
CVE-2023-49595 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted se… |
CVE-2023-49073 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTT… |
CVE-2023-48270 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of netw… |
CVE-2023-47856 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ser… |
CVE-2023-47677 | High | 8.8 | 2024-07-08 | A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted ne… |
CVE-2023-45742 | High | 7.2 | 2024-07-08 | An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HT… |
CVE-2023-45215 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series o… |
CVE-2023-41251 | High | 7.2 | 2024-07-08 | A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP… |
CVE-2023-34435 | High | 7.2 | 2024-07-08 | A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead… |
CVE-2022-25480 | High | 7.8 | 2024-07-02 | Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) bef… |
CVE-2022-25479 | Medium | 5.5 | 2024-07-02 | Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) bef… |
CVE-2022-25478 | High | 7.8 | 2024-07-02 | Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) bef… |
CVE-2022-25477 | Medium | 5.5 | 2024-07-02 | Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) bef… |
CVE-2020-26652 | High | 7.5 | 2023-08-22 | An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service. |
CVE-2022-40740 | High | 7.2 | 2023-01-03 | Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to pe… |
CVE-2022-32967 | Low | 2.1 | 2022-11-29 | RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reb… |
CVE-2022-32966 | Medium | 6.5 | 2022-11-29 | RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service por… |
CVE-2022-34326 | High | 7.5 | 2022-09-27 | In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX t… |
CVE-2022-26529 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthent… |
CVE-2022-26528 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift paramete… |
CVE-2022-26527 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parame… |
CVE-2022-25635 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthentic… |
CVE-2022-27255 | Critical | 9.8 | 2022-08-01 | In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remote… |
CVE-2022-29558 | High | 8.8 | 2022-07-28 | Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface. |
CVE-2022-21742 | Medium | 6.2 | 2022-06-20 | Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker c… |
CVE-2021-39306 | Critical | 9.8 | 2021-12-22 | A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication… |
CVE-2021-43573 | Critical | 9.8 | 2021-11-11 | A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capabilit… |
CVE-2021-36925 | High | 7.8 | 2021-11-02 | RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write o… |
CVE-2021-36924 | High | 7.8 | 2021-11-02 | RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to… |
CVE-2021-36923 | High | 7.8 | 2021-11-02 | RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB d… |
CVE-2021-36922 | High | 7.8 | 2021-11-02 | RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB d… |
CVE-2021-35395 | Critical | 9.8 | 2021-08-16 | Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two… |
CVE-2021-35394 | Critical | 9.8 | 2021-08-16 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affe… |
CVE-2021-35393 | Critical | 9.8 | 2021-08-16 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named… |
CVE-2021-35392 | High | 7.5 | 2021-08-16 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named… |
CVE-2021-32537 | Medium | 6.5 | 2021-07-07 | Realtek HAD contains a driver crashed vulnerability which allows local side attackers to send a special string to the kernel driver in a user’s mode. Due to un… |
CVE-2020-27302 | High | 8.0 | 2021-06-04 | A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-… |
CVE-2020-27301 | High | 8.0 | 2021-06-04 | A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in… |
CVE-2020-23539 | High | 7.5 | 2021-04-08 | An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_R… |
CVE-2021-27372 | Critical | 9.8 | 2021-03-25 | Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build… |
CVE-2020-25857 | High | 7.5 | 2021-02-03 | The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate t… |
CVE-2020-25856 | High | 8.1 | 2021-02-03 | The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the si… |
CVE-2020-25855 | High | 8.1 | 2021-02-03 | The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size p… |
CVE-2020-25854 | High | 8.1 | 2021-02-03 | The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the si… |
CVE-2020-25853 | High | 7.5 | 2021-02-03 | The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size par… |
CVE-2019-18990 | Medium | 5.4 | 2020-09-30 | A partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0, RTL8192ER 2.10, and RTL8881AN 1.09 devices. The vulnerability… |
CVE-2020-9395 | High | 8.0 | 2020-07-06 | An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code… |
CVE-2020-12773 | Critical | 9.6 | 2020-06-08 | A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a default password to exe… |
CVE-2019-11867 | Medium | 5.5 | 2020-02-12 | Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a… |
CVE-2019-19823 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and… |
CVE-2019-19822 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, includ… |
CVE-2017-3767 | High | 7.8 | 2017-11-13 | A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacke… |
CVE-2014-8361 | Critical | 9.8 | 2015-05-01 | The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild thr… |
CVE-2008-5664 | | 2008-12-19 | Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary… | |
CVE-2008-1932 | | 2008-04-25 | Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary cod… | |
CVE-2008-1931 | | 2008-04-25 | Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via… |