CVE-2025-8299: Realtek Wi-Fi USB Driver Privilege Escalation

CVE-2025-8299 Overview

CVE-2025-8299 is a heap-based buffer overflow [CWE-122] in the Realtek rtl81xx SDK Wi-Fi driver. The flaw resides in the MgntActSet_TEREDO_SET_RS_PACKET function, which copies user-supplied data into a fixed-length heap buffer without validating the input length. A local, low-privileged attacker can exploit the condition to run arbitrary code in the context of SYSTEM on affected Windows hosts. The Zero Day Initiative tracked the issue as ZDI-CAN-25857 and published advisory ZDI-25-882. The vulnerability affects Realtek Wi-Fi USB driver deployments on Windows and hardware based on the RTL8811AU chipset.

Critical Impact
Successful exploitation grants full SYSTEM-level code execution from an unprivileged local user account, enabling complete host compromise.

Affected Products

Realtek Wi-Fi USB Driver on Windows (cpe:2.3:a:realtek:wi-fi_usb_driver:*:*:*:*:*:windows:*:*)
Realtek RTL8811AU chipset (cpe:2.3:h:realtek:rtl8811au:-:*:*:*:*:*:*:*)
Third-party OEM Wi-Fi adapters bundling the affected rtl81xx SDK driver

Discovery Timeline

2025-09-02 - CVE-2025-8299 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8299

Vulnerability Analysis

The vulnerability lives inside the MgntActSet_TEREDO_SET_RS_PACKET function of the Realtek rtl81xx SDK Wi-Fi driver. This routine processes Teredo Router Solicitation packet data supplied through driver input paths accessible from user mode. The function allocates a fixed-length buffer on the heap and then copies attacker-controlled data into it without length validation.

Because the driver executes in kernel context, a successful overflow corrupts adjacent kernel heap memory. An attacker with the ability to run code as a low-privileged user can shape the heap and overwrite kernel structures to achieve arbitrary code execution as SYSTEM. The scope change reflected in the CVSS vector indicates that the impact crosses the kernel/user trust boundary.

Root Cause

The root cause is missing bounds checking on the size of user-supplied data before invoking a copy operation into a heap buffer of predetermined size. The MgntActSet_TEREDO_SET_RS_PACKET handler trusts the caller-provided length and payload rather than validating that the payload fits within the destination allocation. This is a classic [CWE-122] heap-based buffer overflow pattern.

Attack Vector

Exploitation requires local access with the ability to execute code on the target system. The attacker interacts with the vulnerable driver through IOCTL calls or associated driver interfaces that reach the MgntActSet_TEREDO_SET_RS_PACKET code path. By crafting an oversized Teredo Router Solicitation payload, the attacker triggers the overflow, corrupts kernel pool metadata or adjacent objects, and pivots to SYSTEM-level execution. No user interaction is needed once the low-privileged code is running.

The Zero Day Initiative advisory ZDI-25-882 documents the vulnerable function and impact. No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2025-8299

Indicators of Compromise

Unexpected loading or interaction with Realtek rtl81xx Wi-Fi driver files (for example rtwlanu.sys, rt8811Au.sys) from non-standard processes.
Kernel pool corruption events, bugcheck codes such as BAD_POOL_HEADER (0x19) or KERNEL_MODE_HEAP_CORRUPTION (0x13A) following driver activity.
Low-privileged processes issuing IOCTLs to the Realtek Wi-Fi driver device object shortly before privilege elevation events.

Detection Strategies

Monitor process creation chains where a non-administrative user context spawns children running as NT AUTHORITY\SYSTEM without a legitimate service parent.
Deploy behavioral endpoint detection to flag anomalous DeviceIoControl traffic targeting Realtek Wi-Fi driver device names.
Alert on installation of outdated or unsigned versions of the Realtek rtl81xx driver on managed endpoints.

Monitoring Recommendations

Ingest Windows kernel crash telemetry and correlate bugchecks with recent driver interaction on the same host.
Track driver inventory across the fleet to identify systems still running vulnerable Realtek Wi-Fi USB driver builds.
Baseline normal Wi-Fi driver IOCTL patterns and alert on outliers, particularly high-volume or oversized input buffers.

How to Mitigate CVE-2025-8299

Immediate Actions Required

Inventory endpoints and OEM systems using Realtek RTL8811AU adapters or the rtl81xx SDK Wi-Fi USB driver on Windows.
Apply the vendor-supplied driver update from Realtek or the affected hardware OEM once available.
Restrict local logon rights on shared and high-value systems to reduce the pool of accounts that can trigger the flaw.
Remove or disable unused Realtek Wi-Fi USB adapters where the driver is not required.

Patch Information

Realtek has not published a public advisory URL in the enriched data for this CVE. Refer to the Zero Day Initiative advisory ZDI-25-882 for coordinated disclosure details, and obtain updated rtl81xx SDK Wi-Fi driver builds directly from Realtek or the hardware OEM distributing the affected adapter.

Workarounds

Uninstall the Realtek Wi-Fi USB driver on systems that do not require the affected adapter.
Use Windows Defender Application Control or similar policy tooling to block loading of vulnerable driver versions by hash or version metadata.
Enforce least-privilege policies and application allowlisting to prevent untrusted local code from reaching driver IOCTL interfaces.
Physically disable USB Wi-Fi adapter usage on kiosk, server, or shared-workstation deployments where wired networking is available.

bash

# Enumerate installed Realtek Wi-Fi drivers on Windows to identify affected hosts
pnputil /enum-drivers | findstr /i "realtek rtl"

# Remove a specific published Realtek driver package by OEM inf name
pnputil /delete-driver oemXX.inf /uninstall /force