A flaw exists in Realtek’s RtUsbA64.sys USB audio driver. During enumeration of a USB device, the driver’s topology‑parsing code can enter an unbounded recursion when it processes a specially crafted USB descriptor. The recursion exhausts the kernel stack, causing an automatic system crash (bugcheck) and resulting in a denial of service. This attack does not require any privileged or authenticated user session.

The affected product is Realtek’s RtUsbA64.sys USB audio driver. No specific version information is supplied in the vulnerability report, so all releases that include the legacy topology‑parsing routine may be impacted. The driver is used on Windows systems that support Realtek USB audio hardware.

The vulnerability is exploitable by a physically present attacker who supplies a malicious USB device that triggers the offending descriptor. Because it requires only local physical access and no authentication, the risk of exploitation is high in environments where users can plug USB devices at will. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the nature of the bug—kernel stack exhaustion and automatic crash—indicates a high severity. No public exploits are reported yet; however, the potential for a repeatable crash makes it a serious risk.