Junglewise Threat Intelligence

CVE-2025-60419: Realtek NDIS Usermode IO driver denial of service in RtkIOAC60.sys

CVE-2025-60419 · Severity: medium · CVSS 6.2 · Published 2025-10-24

Executive brief

A vulnerability exists in a Realtek network driver component used for low-level communication between the operating system and network hardware. A local user can exploit this flaw to crash the system, leading to a blue screen and a complete loss of availability. This could be used by a malicious actor to disrupt operations or interfere with security software running on the machine.

Technical details

A null-pointer dereference vulnerability exists in the Realtek NDIS Usermode IO driver (RtkIOAC60.sys) version 6.0.5600.16348. The flaw is located within the IOCTL handling logic, specifically when processing the IOCTL_NDISPROT_SET_EVENT (0x12C8C0) request. An attacker can trigger the crash by sending a crafted I/O Control (IOCTL) request with an empty IRP buffer. Because the driver fails to validate the presence of the buffer before attempting to set an NDIS event, it dereferences a null pointer, resulting in a kernel-mode crash (BSOD). This requires local access to the system to interact with the device object \\.\RTKIOAC60.

Affected products

  • Realtek Semiconductor Corp. NDIS Usermode IO driver (RtkIOAC60.sys) 6.0.5600.16348

Timeline

  • 2025-10-24: disclosed
  • 2025-10-24: advisory

References