# CVE-2026-36355: Realtek rtl819x Jungle SDK Kernel Memory Read/Write in Wi-Fi Driver

Source: https://junglewise.ai/threats/cve-2026-36355-realtek-rtl819x-jungle-sdk-kernel-memory-read-write-in-wi-fi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-36355 · Severity: high · CVSS 7.7 · Published 2026-05-05

A vulnerability exists in the Wi-Fi software driver used by many home and enterprise routers and networking devices. This flaw allows a person with basic access to the device's command line to bypass security protections and gain full administrative (root) control. Once in control, an attacker could monitor network traffic, modify device settings, or use the device as a foothold to attack other systems on the network.

Vendors: [Realtek](https://junglewise.ai/threats/vendors/realtek).

## Quick answers

**Is CVE-2026-36355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36355 being exploited in the wild.

**How severe is CVE-2026-36355?** High severity, with a CVSS score of 7.7, published 5 May 2026.

**Which products and versions are affected?** Realtek rtl819x Jungle SDK All versions through v3.4.14B.

**Is there a fix for CVE-2026-36355?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36355 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-36355?** Check whether you run Realtek rtl819x Jungle SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rtl8192cd Wi-Fi kernel driver fails to implement access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers. These handlers are enabled in production builds because the _IOCTL_DEBUG_CMD_ macro is unconditionally defined in the driver configuration. A local attacker can use these IOCTLs to perform arbitrary kernel memory reads and writes without requiring root privileges or specialized capabilities. This primitive can be used to overwrite process credentials (e.g., task_struct->cred) to achieve local privilege escalation (LPE) to root. The vulnerability affects the Realtek rtl819x Jungle SDK through version v3.4.14B and is present in various driver variants including rtl8192cd, rtl8192es, and others.

## Affected products

- Realtek rtl819x Jungle SDK All versions through v3.4.14B

## Timeline

- 2026-02-23: other: Vulnerability confirmed in test environment
- 2026-05-03: disclosed: Initial disclosure by researcher
- 2026-05-05: advisory: NVD publication date

## References

- [https://github.com/totekuh/CVE-2026-36355](https://github.com/totekuh/CVE-2026-36355)