Executive brief
A vulnerability exists in a Realtek network driver component used for low-level communication between the operating system and network hardware. A local user can exploit this flaw to crash the system, leading to a blue screen and a complete loss of availability. This could be used by a malicious actor to disrupt operations or interfere with security software running on the machine.
Technical details
A null-pointer dereference vulnerability exists in the Realtek NDIS Usermode IO driver (RtkIOAC60.sys) version 6.0.5600.16348. The flaw is located within the IOCTL handling logic, specifically when processing the IOCTL_NDISPROT_SET_EVENT (0x12C8C0) request. An attacker can trigger the crash by sending a crafted I/O Control (IOCTL) request with an empty IRP buffer. Because the driver fails to validate the presence of the buffer before attempting to set an NDIS event, it dereferences a null pointer, resulting in a kernel-mode crash (BSOD). This requires local access to the system to interact with the device object \\.\RTKIOAC60.
Affected products
- Realtek Semiconductor Corp. NDIS Usermode IO driver (RtkIOAC60.sys) 6.0.5600.16348
Timeline
- 2025-10-24: disclosed
- 2025-10-24: advisory