CVE-2020-37252 Overview
CVE-2020-37252 is an unquoted service path vulnerability affecting Realtek Audio Service version 1.0.0.55. The flaw resides in RtkAudioService64.exe, where the service is registered with a path containing spaces but lacking surrounding quotes. Local attackers with write access to an intermediate directory can place a malicious executable that Windows will load with LocalSystem privileges when the service starts or the system reboots. The weakness is classified under CWE-428: Unquoted Search Path or Element.
Critical Impact
Successful exploitation grants arbitrary code execution as LocalSystem, providing full administrative control of the affected Windows host.
Affected Products
- Realtek Audio Service 1.0.0.55
- RtkAudioService64.exe binary as registered by the installer
- Windows systems running the affected Realtek audio driver package
Discovery Timeline
- 2026-06-19 - CVE-2020-37252 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2020-37252
Vulnerability Analysis
The vulnerability is an unquoted service path weakness in the Windows service registration for Realtek Audio Service. When the Service Control Manager (SCM) parses an unquoted ImagePath registry value that contains spaces, it attempts to load executables at each space-delimited prefix. If an attacker can write to any directory along that path, Windows will execute the attacker-supplied binary instead of the intended service executable.
Because the service runs as LocalSystem, the injected binary inherits the highest privilege level on the host. This allows a low-privileged local user to escalate to full system control. The flaw aligns with CWE-428 and is a well-documented class of Windows privilege escalation.
Root Cause
The root cause is the installer registering RtkAudioService64.exe with an ImagePath value that includes spaces but is not enclosed in quotation marks. Windows service path parsing then evaluates each tokenized segment as a candidate executable. The vulnerability requires no memory corruption or logic flaw in the service itself, only the misconfigured registration.
Attack Vector
An attacker must already have local access with permission to write to a directory along the unquoted service path. The attacker drops a crafted executable matching the parsed path prefix. On the next service start or system reboot, the SCM launches the planted binary as LocalSystem. Public exploitation details for this class of issue are documented in Exploit-DB entry 49015 and the VulnCheck advisory.
Detection Methods for CVE-2020-37252
Indicators of Compromise
- Unexpected executable files placed along the Realtek service path, such as C:\Program.exe or similar names matching a space-delimited prefix of RtkAudioService64.exe
- New child processes spawned by services.exe running as NT AUTHORITY\SYSTEM that are not the legitimate Realtek binary
- Modification of the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\RtkAudioService
Detection Strategies
- Enumerate Windows services and flag any ImagePath value containing spaces without surrounding quotes using wmic service get name,pathname,startmode or PowerShell Get-CimInstance Win32_Service.
- Alert on file creation events in root directories or Program Files paths where the filename matches a tokenized prefix of a known service path.
- Correlate service start events (Event ID 7036) with the hash and signer of the launched executable to identify unsigned or unexpected binaries.
Monitoring Recommendations
- Monitor write activity on C:\ root and parent directories of service binaries for non-administrative users.
- Audit registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\* keys with Sysmon Event ID 13.
- Track LocalSystem process creation chains originating from services.exe to detect anomalous child executables.
How to Mitigate CVE-2020-37252
Immediate Actions Required
- Inventory all installed services and identify entries with unquoted paths that contain spaces, prioritizing RtkAudioService64.exe.
- Restrict write permissions on C:\ and any parent directory of service executables so that non-administrative users cannot drop files.
- Update Realtek audio drivers to the latest version available from the Realtek official download portal.
Patch Information
No specific vendor patch identifier is listed in the NVD record for Realtek Audio Service 1.0.0.55. Administrators should obtain the most recent driver package from the Realtek official website and validate that the reinstalled service registers ImagePath with proper quoting. Additional context is available in the VulnCheck advisory.
Workarounds
- Manually correct the affected service registration by enclosing the ImagePath in quotes using sc config RtkAudioService binPath= "\"C:\Path To\RtkAudioService64.exe\"" from an elevated prompt.
- Apply restrictive ACLs on directories along the unquoted path to deny write access to standard users.
- Disable the Realtek Audio Service on systems that do not require it until remediation is complete.
# Configuration example: correct an unquoted service path
sc config RtkAudioService binPath= "\"C:\Program Files\Realtek\Audio\RtkAudioService64.exe\""
# Verify the change
sc qc RtkAudioService
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
