CVE-2019-25345: Realtek IIS Codec Privilege Escalation

CVE-2019-25345 Overview

CVE-2019-25345 is an unquoted service path vulnerability affecting Realtek IIS Codec Service version 6.4.10041.133. This security flaw allows local attackers to potentially execute arbitrary code by exploiting the unquoted path in the Windows service configuration. By placing a malicious executable in a strategic location along the service path, attackers can achieve privilege escalation on vulnerable systems.

Critical Impact

Local attackers can leverage this unquoted service path vulnerability to execute arbitrary code with elevated privileges, potentially gaining full control of the affected system.

Affected Products

• Realtek IIS Codec Service 6.4.10041.133
• Windows systems with the vulnerable Realtek audio driver installed
• Systems where the service runs with elevated privileges

Discovery Timeline

• 2026-02-12 - CVE-2019-25345 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2019-25345

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a class of vulnerabilities that occurs when a Windows service path containing spaces is not properly enclosed in quotation marks. When Windows attempts to start a service with an unquoted path like C:\Program Files\Realtek\Audio\HDA\RTKIsCodecService.exe, the operating system parses the path by attempting to execute each space-separated component sequentially.

The attack requires local access to the system and the ability to write files to specific directories within the service path. If successful, an attacker can execute malicious code with the same privileges as the vulnerable service, typically SYSTEM-level privileges for Windows services. This makes the vulnerability particularly dangerous in enterprise environments where multiple users may have access to shared workstations.

Root Cause

The root cause of this vulnerability lies in improper service registration within the Windows Registry. When the Realtek IIS Codec Service was installed, the ImagePath registry value was configured without proper quotation marks around the executable path. Windows service paths containing spaces must be enclosed in double quotes to ensure the operating system correctly identifies the full path to the executable. Without these quotes, Windows interprets spaces as argument delimiters, creating opportunities for path interception attacks.

Attack Vector

This is a local attack vector vulnerability. An attacker with local user access to a vulnerable system can exploit this flaw by creating a malicious executable file in a location that Windows will attempt to execute before reaching the legitimate service executable.

For example, if the service path is C:\Program Files\Realtek\Audio\HDA\RTKIsCodecService.exe, Windows will attempt to execute in this order:

1. C:\Program.exe
2. C:\Program Files\Realtek\Audio\HDA\RTKIsCodecService.exe

If an attacker can write to the C:\ directory, they could place a malicious Program.exe file that would execute with the service's privileges when the service starts or restarts. The exploitation of this vulnerability can lead to full system compromise through privilege escalation from a standard user to SYSTEM-level access.

Detection Methods for CVE-2019-25345

Indicators of Compromise

• Unexpected executable files named Program.exe in root directories or along common service paths
• Suspicious modifications to the C:\Program Files\Realtek\ directory structure
• Unusual process execution with SYSTEM privileges originating from non-standard locations
• Registry modifications to service ImagePath values

Detection Strategies

• Query Windows Registry for unquoted service paths using PowerShell or WMI commands to identify vulnerable services
• Monitor file system activity for creation of executables in root directories or locations matching partial service paths
• Implement application whitelisting to prevent unauthorized executables from running with elevated privileges
• Use endpoint detection and response (EDR) solutions to identify anomalous service behavior

Monitoring Recommendations

• Enable audit logging for file creation events in directories commonly targeted by unquoted path attacks
• Monitor Windows Event Log for Service Control Manager events indicating service failures or unexpected service starts
• Implement SentinelOne Singularity Platform for real-time behavioral analysis and automated threat detection
• Review service configurations periodically to identify newly introduced unquoted service paths

How to Mitigate CVE-2019-25345

Immediate Actions Required

• Audit all Windows services on affected systems to identify unquoted service paths using available security tools
• Restrict write permissions to directories along the service path, particularly root directories
• Update Realtek audio drivers to the latest available version from Realtek Official Website
• Deploy SentinelOne agents to monitor for exploitation attempts and provide automated remediation

Patch Information

Administrators should check for updated Realtek audio drivers that address this service path configuration issue. Refer to the VulnCheck Advisory RTK-IIS-Codec for detailed information and the Exploit-DB #47642 entry for technical details about this vulnerability.

Workarounds

• Manually correct the service path by adding quotation marks around the ImagePath value in the Windows Registry
• Implement strict file system permissions to prevent unauthorized users from writing to directories in the service path
• Use Group Policy to restrict executable execution from non-standard locations
• Consider disabling the vulnerable service if it is not required for system functionality

# Registry fix example - add quotes to service path
# Open Registry Editor and navigate to:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RTKIsCodecService
# Modify ImagePath from:
# C:\Program Files\Realtek\Audio\HDA\RTKIsCodecService.exe
# To:
# "C:\Program Files\Realtek\Audio\HDA\RTKIsCodecService.exe"

# PowerShell command to identify unquoted service paths:
Get-WmiObject Win32_Service | Where-Object { $_.PathName -match '^[^"].*\s.*[^"]$' } | Select-Object Name, PathName