CVE-2019-11867

MEDIUM 5.5CVE-2019-11867 · Published 12/02/2020 · updated 17/06/2026

In short

CVE-2019-11867 is a MEDIUM (CVSS 5.5) vulnerability affecting ndis (realtek).
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 21.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ndis realtek	`= 10.1.505.2015`	No fix yet

Description

Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0.

References

downwithup.github.io/CVEPosts.html · Third Party Advisory
realtek.cz/realtek-network-drivers.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free