A local privilege escalation vulnerability in Realtek IIS Codec Service allows attackers to execute arbitrary code on the host system.

The software suffers from an unquoted service path vulnerability (CWE-428), where the service executable path contains spaces and lacks quotation marks. A local attacker with low privileges can exploit this by placing a malicious executable in a parent directory, which the service will then execute with elevated system privileges.

The ability for a local attacker to execute arbitrary code as a system-level process poses a severe risk of complete system compromise. Given the CVSS score of 7.8, this vulnerability is categorized as High severity, as it enables unauthorized access to sensitive data, installation of persistent backdoors, and potential lateral movement within the network.

Immediate Action: Since a specific patch is not identified, administrators should manually configure the service path to include the necessary quotation marks or disable the service if it is not required for business operations.

Proactive Monitoring: Monitor system event logs for unexpected process creation events originating from the Realtek installation directory and track service configuration changes.

Compensating Controls: Implement strict file system permissions on the C: drive and program directories to prevent unauthorized users from writing or modifying files in high-level folders.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 47642).

This vulnerability represents a significant risk to local system integrity. Administrators must prioritize the remediation of the unquoted service path by either applying vendor-provided updates if they become available or manually enforcing correct path quoting in the Windows Registry to mitigate the risk of privilege escalation.