CVE-2025-8302: Realtek Wi-Fi USB Driver Privilege Escalation

CVE-2025-8302 Overview

CVE-2025-8302 is a heap-based buffer overflow [CWE-122] in the Realtek rtl81xx SDK Wi-Fi driver (rtwlanu) on Windows. The flaw resides in the N6CSet_DOT11_CIPHER_DEFAULT_KEY function, which copies user-supplied data into a fixed-length heap buffer without validating its length. A local attacker with the ability to run low-privileged code can trigger the overflow and execute arbitrary code in the context of SYSTEM. The Zero Day Initiative tracks this issue as ZDI-CAN-26553 and published it as advisory ZDI-25-879.

Critical Impact
Successful exploitation grants SYSTEM-level code execution from a low-privileged local account, resulting in full compromise of the affected Windows host.

Affected Products

Realtek Wi-Fi USB Driver (rtwlanu) for Windows
Realtek RTL8811AU Wi-Fi hardware
Systems using the Realtek rtl81xx SDK Wi-Fi driver

Discovery Timeline

2025-09-02 - CVE-2025-8302 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8302

Vulnerability Analysis

The vulnerability sits inside N6CSet_DOT11_CIPHER_DEFAULT_KEY, an IOCTL handler within the Realtek rtwlanu Wi-Fi driver. The function accepts a cipher default key structure from user mode and copies its contents into a fixed-size heap allocation. Because the driver does not check the caller-supplied length against the destination buffer size, an oversized input corrupts adjacent heap memory. Attackers can shape the heap layout and overwrite kernel-controlled objects such as function pointers, dispatch tables, or synchronization structures. Once control flow is redirected, the attacker executes code inside the kernel driver, which runs at SYSTEM privileges. Local privilege escalation flaws in Wi-Fi drivers are a recurring target because they expose a wide IOCTL surface to unprivileged callers and are frequently pre-installed on OEM Windows builds.

Root Cause

The root cause is missing length validation prior to a memory copy operation into a heap-allocated buffer [CWE-122]. The rtwlanu driver trusts the size field supplied by the caller through the IOCTL interface rather than enforcing a hard upper bound tied to the destination buffer.

Attack Vector

Exploitation is local. The attacker must already run code in a low-privileged user context on the target system, then open a handle to the Realtek Wi-Fi driver device and issue a crafted IOCTL that reaches N6CSet_DOT11_CIPHER_DEFAULT_KEY. No user interaction is required, and the attack complexity is low. Because the scope changes to kernel, the resulting SYSTEM shell can disable endpoint controls, dump credentials, and pivot laterally.

// No public proof-of-concept has been released. See the
// Zero Day Initiative advisory ZDI-25-879 for technical details:
// https://www.zerodayinitiative.com/advisories/ZDI-25-879/

Detection Methods for CVE-2025-8302

Indicators of Compromise

Unexpected loading or crashes of the rtwlanu.sys driver in Windows Event Log or WER reports.
Bug checks referencing the Realtek Wi-Fi driver, particularly heap corruption codes such as BAD_POOL_HEADER or KERNEL_MODE_HEAP_CORRUPTION.
Non-administrative processes opening handles to the Realtek Wi-Fi driver device object and issuing device I/O control requests.

Detection Strategies

Monitor for low-privileged processes that call DeviceIoControl against the Realtek Wi-Fi driver device path.
Alert on child processes spawned as NT AUTHORITY\SYSTEM from parents running under standard user tokens shortly after Wi-Fi driver interaction.
Correlate driver crashes in rtwlanu.sys with subsequent privilege changes on the host.

Monitoring Recommendations

Inventory endpoints running Realtek Wi-Fi USB drivers and track installed versions against vendor advisories.
Enable kernel-mode crash telemetry and forward Minidump artifacts to a central location for triage.
Baseline expected IOCTL activity to the Wi-Fi driver so anomalous callers surface quickly.

How to Mitigate CVE-2025-8302

Immediate Actions Required

Identify hosts with the Realtek rtwlanu Wi-Fi driver installed, including OEM laptop images and USB Wi-Fi adapter drivers.
Update to a Realtek Wi-Fi driver release that addresses the N6CSet_DOT11_CIPHER_DEFAULT_KEY bounds check once the vendor publishes a fix.
Restrict local logon rights and remove standard users from systems that cannot be patched immediately.

Patch Information

No vendor advisory URL is listed in the NVD entry at publication. Refer to the Zero Day Initiative Advisory ZDI-25-879 for coordinated disclosure details, and consult Realtek and affected OEMs for updated driver packages for the RTL8811AU and related rtl81xx chipsets.

Workarounds

Uninstall or disable the Realtek Wi-Fi USB driver on systems that do not require the affected adapter.
Use Windows Defender Application Control or driver blocklists to prevent vulnerable versions of rtwlanu.sys from loading.
Enforce least privilege so that untrusted code cannot execute locally to reach the vulnerable IOCTL surface.

bash

# Enumerate the Realtek Wi-Fi driver on a Windows host
pnputil /enum-drivers | findstr /I "rtwlanu Realtek"

# Query the loaded driver version
driverquery /v /fo list | findstr /I "rtwlanu"

# Disable the associated device (run elevated) once identified
# Replace <InstanceId> with the value from: Get-PnpDevice -Class Net
# Get-PnpDevice -Class Net | Where-Object FriendlyName -like "*Realtek*802.11*"
# Disable-PnpDevice -InstanceId "<InstanceId>" -Confirm:$false