# CVE-2016-20085: Realtek High Definition Audio Driver unquoted service path privilege escalation

Source: https://junglewise.ai/threats/cve-2016-20085-realtek-high-definition-audio-driver-unquoted-service-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2016-20085 · Severity: high · CVSS 7.8 · Published 2026-06-19

The Realtek High Definition Audio Driver, which manages audio hardware on Windows computers, contains a configuration flaw. A local user with limited access can exploit this to run their own programs with full administrative (System) control. This could allow an attacker to take complete control of the machine, bypass security restrictions, or access sensitive data.

Vendors: [Realtek](https://junglewise.ai/threats/vendors/realtek).

## Quick answers

**Is CVE-2016-20085 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-20085 being exploited in the wild.

**How severe is CVE-2016-20085?** High severity, with a CVSS score of 7.8, published 19 June 2026.

**Which products and versions are affected?** Realtek High Definition Audio Driver 6.0.1.6730.

**Is there a fix for CVE-2016-20085?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-20085 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2016-20085?** Check whether you run Realtek High Definition Audio Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Realtek High Definition Audio Driver (specifically RtkAudioService) installs with an unquoted service path containing spaces (e.g., C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe). This is a CWE-428 vulnerability where the Windows Service Control Manager may misinterpret the path. A local attacker with write permissions to the root or intermediate directories can place a malicious executable (e.g., C:\Program.exe) that will be executed instead of the legitimate service binary upon the next service restart or system reboot. Because the service runs as LocalSystem, the attacker's code will execute with the highest possible privileges on the local machine. This was verified on version 6.0.1.6730 on Windows 7.

## Affected products

- Realtek High Definition Audio Driver 6.0.1.6730

## Timeline

- 2016-10-19: disclosed: Original exploit published on Exploit-DB
- 2026-06-19: advisory: NVD and VulnCheck published formal advisory details

## References

- [https://www.exploit-db.com/exploits/40587](https://www.exploit-db.com/exploits/40587)
- [https://www.vulncheck.com/advisories/realtek-high-definition-audio-driver-privilege-escalation](https://www.vulncheck.com/advisories/realtek-high-definition-audio-driver-privilege-escalation)