CVE-2020-37252 HIGH

CVE-2020-37252: Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation

Vendor Realtek

Product Realtek Audio Service

Weakness CWE-428

Published June 19, 2026

Last update July 28, 2026

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

Key dates

02Disclosure timeline

June 19, 2026 CVE published

July 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-37252 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/428.html AskarLabs — CWE-428 write-up Unquoted Search Path or Element