CVE-2025-8301: Realtek Wi-Fi USB Driver Privilege Escalation

CVE-2025-8301 Overview

CVE-2025-8301 is a heap-based buffer overflow in the Realtek RTL8811AU Wi-Fi USB driver (rtwlanu.sys) on Windows. The flaw resides in the N6CSet_DOT11_CIPHER_DEFAULT_KEY function, which copies user-supplied data to a fixed-length heap buffer without validating its length. A local attacker with the ability to execute low-privileged code can trigger the overflow and gain SYSTEM-level code execution. The issue was reported through the Zero Day Initiative as ZDI-CAN-24786 and published in advisory ZDI-25-880. It maps to [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
Successful exploitation allows local attackers to escalate from low-privileged user context to arbitrary code execution as NT AUTHORITY\SYSTEM.

Affected Products

Realtek Wi-Fi USB Driver for Windows
Realtek RTL8811AU wireless USB adapter driver (rtwlanu.sys)
Third-party USB Wi-Fi products bundling the Realtek RTL8811AU driver

Discovery Timeline

2025-09-02 - CVE-2025-8301 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8301

Vulnerability Analysis

The vulnerability exists inside the N6CSet_DOT11_CIPHER_DEFAULT_KEY handler within the rtwlanu.sys kernel-mode driver. This routine services an OID request used to configure default cipher keys for 802.11 associations. Attacker-controlled input from user mode is copied into a fixed-size heap allocation in the driver without a preceding bounds check.

Because the overflow occurs in a kernel pool allocation, an attacker can corrupt adjacent pool objects and, through pool grooming, redirect execution or overwrite kernel structures. The result is arbitrary code execution in the SYSTEM security context, enabling persistence, credential theft, or disabling of endpoint protections.

Exploitation requires only local, low-privileged access. No user interaction is needed once the attacker can invoke the driver's device I/O interface, typically via DeviceIoControl against the driver's exposed device object.

Root Cause

The root cause is missing length validation on user-supplied data prior to a copy into a fixed-length heap buffer inside N6CSet_DOT11_CIPHER_DEFAULT_KEY. The handler trusts a caller-provided size field and does not compare it against the destination buffer capacity before invoking the copy operation, satisfying the classic [CWE-122] pattern.

Attack Vector

A local attacker running unprivileged code opens a handle to the Realtek Wi-Fi driver device and issues a crafted I/O control request that reaches the vulnerable OID handler. The request carries an oversized cipher-key payload that overflows the fixed-length pool buffer, corrupting adjacent kernel memory and yielding SYSTEM code execution. Refer to the Zero Day Initiative Advisory ZDI-25-880 for additional technical context.

Detection Methods for CVE-2025-8301

Indicators of Compromise

Unexpected loading of rtwlanu.sys on endpoints without Realtek RTL8811AU hardware attached.
Kernel bugchecks (BSOD) referencing rtwlanu.sys or pool corruption stop codes such as BAD_POOL_HEADER shortly after low-privileged process activity.
New SYSTEM-context processes spawned from lineage rooted in a standard user session immediately after driver I/O activity.

Detection Strategies

Hunt for user-mode processes opening handles to Realtek Wi-Fi device objects and issuing DeviceIoControl calls with abnormally large input buffers.
Alert on privilege transitions where a medium- or low-integrity process is followed by SYSTEM-level child process creation on hosts loading rtwlanu.sys.
Correlate driver load events with subsequent kernel exceptions or unsigned code execution attempts in kernel memory.

Monitoring Recommendations

Inventory endpoints for the presence and version of rtwlanu.sys and flag out-of-date driver files.
Monitor Windows Event Log channels for driver crash telemetry (Application Error, WHEA-Logger) tied to the Realtek Wi-Fi stack.
Log kernel driver load and unload events (Sysmon Event ID 6) and baseline expected Realtek versions across the fleet.

How to Mitigate CVE-2025-8301

Immediate Actions Required

Identify all systems with the Realtek RTL8811AU Wi-Fi USB driver installed and prioritize patching based on user privilege exposure.
Restrict local execution on affected hosts by enforcing application allowlisting and removing unnecessary local administrator rights.
Where the RTL8811AU adapter is not required, uninstall the driver and physically remove the USB adapter.

Patch Information

At the time of publication, no vendor advisory URL is listed in the CVE record. Organizations should obtain the latest RTL8811AU driver package directly from Realtek or from the OEM that shipped the USB adapter, and consult ZDI-25-880 for disclosure status. Apply the updated rtwlanu.sys binary once released and verify the driver version after reboot.

Workarounds

Disable or uninstall the Realtek RTL8811AU driver on systems that do not require the adapter.
Enforce Windows Defender Application Control or AppLocker policies to block untrusted local binaries that could invoke the vulnerable driver.
Enable Hypervisor-Protected Code Integrity (HVCI) and Kernel Mode Code Integrity to raise the cost of kernel exploitation.

bash

# Query and remove the Realtek RTL8811AU driver on Windows (run as Administrator)
pnputil /enum-drivers | findstr /I "rtwlanu"
pnputil /delete-driver oemXX.inf /uninstall /force