CVE-2016-20085: Realtek Audio Driver Privilege Escalation

CVE-2016-20085 Overview

CVE-2016-20085 affects Realtek High Definition Audio Driver version 6.0.1.6730. The driver registers a Windows service with an unquoted file system path [CWE-428]. A local attacker who can write to a directory referenced by the unquoted path can plant a malicious executable that the Service Control Manager loads at service start. Successful exploitation runs attacker code with LocalSystem privileges, granting full control of the host.

Critical Impact
Local privilege escalation to LocalSystem through an unquoted service path in the Realtek HD Audio driver, enabling complete host compromise after initial access.

Affected Products

Realtek High Definition Audio Driver 6.0.1.6730
Windows endpoints shipping the affected Realtek audio service
OEM systems bundling the vulnerable driver version

Discovery Timeline

2026-06-19 - CVE-2016-20085 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2016-20085

Vulnerability Analysis

The Realtek HD Audio Driver installs a Windows service whose ImagePath registry value is stored without surrounding quotation marks and contains spaces. When the Service Control Manager parses an unquoted path containing spaces, it attempts to load each space-delimited prefix as an executable before reaching the intended binary. An attacker who can write to any intermediate directory on the path can drop a payload that the operating system will execute on the next service start.

The weakness is classified under [CWE-428] (Unquoted Search Path or Element). Exploitation requires existing local access and write permission on a directory in the service path. The audio service typically runs under LocalSystem, so any code launched through this vector inherits the highest privilege available on the host.

Root Cause

The service was registered with an installer that did not enclose the executable path in double quotes. Windows resolves unquoted paths left to right, treating spaces as delimiters between an executable name and command line arguments. This parsing rule turns a benign installation choice into a hijack opportunity whenever a non-privileged directory sits earlier on the path than the legitimate binary.

Attack Vector

An authenticated local user identifies the unquoted ImagePath using sc qc or by inspecting HKLM\SYSTEM\CurrentControlSet\Services. The attacker places a crafted executable in a writable directory that matches the truncated prefix. Restarting the service, rebooting the host, or waiting for a scheduled restart triggers the Service Control Manager to launch the attacker's binary as LocalSystem. The vulnerability mechanism is documented in the Exploit-DB entry #40587 and the VulnCheck Realtek Advisory.

Detection Methods for CVE-2016-20085

Indicators of Compromise

Unexpected executable files placed in directories that appear as prefixes within the Realtek audio service ImagePath.
Service start events where the resolved binary differs from the Realtek installation directory.
New child processes of services.exe running from non-standard paths under LocalSystem.

Detection Strategies

Enumerate services with wmic service get name,pathname,startmode and flag any unquoted pathname values containing spaces.
Audit registry values under HKLM\SYSTEM\CurrentControlSet\Services\*\ImagePath for missing surrounding quotes.
Correlate service start events (Event ID 7036) with file creation events in path prefix directories.

Monitoring Recommendations

Alert on file writes to root-level directories such as C:\Program.exe or C:\Program Files\Realtek.exe.
Track changes to service configuration through Security Event ID 4697 and registry auditing on the Services hive.
Monitor for privilege transitions where a non-administrative user precedes a process executing as LocalSystem.

How to Mitigate CVE-2016-20085

Immediate Actions Required

Inventory endpoints running Realtek HD Audio Driver 6.0.1.6730 and prioritize remediation.
Update the affected service ImagePath registry value to wrap the full executable path in double quotes.
Restrict write permissions on C:\ and other directories that appear as prefixes within unquoted service paths.

Patch Information

No vendor patch reference is recorded in the NVD entry for CVE-2016-20085. Administrators should upgrade to a current Realtek High Definition Audio Driver release supplied by the system OEM or by Realtek, then verify that the new installer registers the service with a quoted ImagePath. Consult the VulnCheck Realtek Advisory for additional remediation context.

Workarounds

Manually quote the ImagePath value for the Realtek audio service in the registry and restart the host.
Remove write access for standard users on every directory referenced by the unquoted path prefix.
Disable the vulnerable service on systems where audio functionality is not required.

bash

# Configuration example
# Inspect the service path, then enforce quoting
sc qc RtkAudioService
reg add "HKLM\SYSTEM\CurrentControlSet\Services\RtkAudioService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe\"" /f