{"api_version":"1","generated_at":"2026-11-08T22:25:59+00:00","cve":"CVE-2026-90975","urls":{"html":"https://cve.report/CVE-2026-90975","api":"https://cve.report/api/cve/CVE-2026-90975.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90975","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975"},"summary":{"title":"CVE-2026-90975","description":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","state":"PUBLISHED","assigner":"certcc","published_at":"2026-11-06 19:17:59","updated_at":"2026-11-06 20:17:28"},"problem_types":["CWE-822"],"metrics":[],"references":[{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975","name":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975","refsource":"cret@cert.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.kb.cert.org/vuls/id/701544","name":"https://www.kb.cert.org/vuls/id/701544","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90975","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90975","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Realtek","product":"RtUsbA64.sys","version":"affected 6.3.9600.2393","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90975","cve":"CVE-2026-90975","epss":"0.001850000","percentile":"0.081790000","score_date":"2026-11-07","updated_at":"2026-11-08 00:06:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-06T19:11:47.406Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/701544"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"RtUsbA64.sys","vendor":"Realtek","versions":[{"status":"affected","version":"6.3.9600.2393"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution."}],"problemTypes":[{"descriptions":[{"description":"CWE-822","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-06T18:36:42.089Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975"}],"source":{"discovery":"UNKNOWN"},"title":"CVE-2026-90975","x_generator":{"engine":"VINCE 4.0.1","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-90975"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-90975","datePublished":"2026-11-06T18:36:42.089Z","dateReserved":"2026-09-14T13:39:39.619Z","dateUpdated":"2026-11-06T19:11:47.406Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-06 19:17:59","lastModifiedDate":"2026-11-06 20:17:28","problem_types":["CWE-822"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90975","Ordinal":"1","Title":"CVE-2026-90975","CVE":"CVE-2026-90975","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90975","Ordinal":"1","NoteData":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.","Type":"Description","Title":"CVE-2026-90975"}]}}}