What is the CVSS score of CVE-2026-36355?

CVE-2026-36355 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Realtek rtl819x Jungle SDK are affected by CVE-2026-36355?

Realtek rtl819x Wi-Fi driver versions through 3.4.14B contain an arbitrary kernel memory read/write vulnerability exploitable by local attackers without special privileges, enabling privilege…

Is there a public PoC exploit available for CVE-2026-36355?

Yes, a public proof-of-concept exploit is available for CVE-2026-36355. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-36355?

Within 24 hours: Identify and inventory all devices running Realtek rtl819x Jungle SDK driver (rtl8192cd) by conducting network scans and device audits; document versions through 3.4.14B as critical. Within 7 days: Isolate affected devices to network segments with restricted access and disable local user access where operationally feasible; contact Realtek for patch timeline and ETA. Within 30 days: Evaluate firmware/OS alternatives from vendors with active security support; implement application-level privilege restrictions; deploy endpoint detection and response (EDR) monitoring for suspicious kernel access patterns on affected systems.

Realtek rtl819x Jungle SDK CVE-2026-36355

EUVD-2026-27325 HIGH

Information Exposure (CWE-200)

2026-05-05 mitre

Information Disclosure N A

7.7

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 18:22 vuln.today

CVSS changed

May 05, 2026 - 18:22 NVD

7.7 (HIGH)

DescriptionCVE.org

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h

AnalysisAI

Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to access and modify kernel memory through debug ioctl handlers (0x89F5/0x89F6) that were left enabled in production builds. All known SDK versions through v3.4.14B are affected. A publicly available exploit exists (GitHub repository CVE-2026-36355), enabling privilege escalation and data exfiltration on devices using the vulnerable rtl8192cd driver. EPSS data unavailable; not currently in CISA KEV.

Technical ContextAI

The vulnerability exists in the rtl8192cd kernel driver component of Realtek's rtl819x Jungle Software Development Kit, which provides Wi-Fi functionality for embedded Linux devices. The root cause (CWE-200: Information Disclosure) stems from two debug ioctl handlers - write_mem (0x89F5) and read_mem (0x89F6) - that were intended for development/debugging but remained active in production firmware due to the unconditional definition of the _IOCTL_DEBUG_CMD_ preprocessor macro in 8192cd_cfg.h. These handlers provide direct kernel memory access primitives without implementing any authorization checks, permission boundaries, or capability requirements. This SDK is commonly integrated into consumer routers, access points, and IoT devices from multiple manufacturers who incorporate Realtek wireless chipsets, creating widespread exposure across the embedded device ecosystem.

RemediationAI

No vendor-released patch version has been identified at time of analysis. Device owners should check manufacturer support pages for firmware updates addressing CVE-2026-36355, as OEM vendors must integrate fixes from Realtek and release updated firmware packages. For devices without available patches, implement compensating controls with understanding of operational trade-offs: (1) Disable Wi-Fi driver module if wired connectivity suffices (prevents normal wireless operation); (2) Restrict physical and management interface access to trusted administrators only, reducing local access attack surface; (3) Deploy network segmentation isolating affected devices from sensitive systems (does not prevent device compromise but limits lateral movement); (4) Monitor for unusual ioctl system calls or kernel memory access patterns through host-based intrusion detection if available. For embedded devices at end-of-life, replacement with patched hardware may be the only effective long-term mitigation. Exploitation proof-of-concept available at https://github.com/totekuh/CVE-2026-36355 can be used for defensive testing of deployed devices. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-36355.