Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation

A local attacker with write access to the `C:\Program Files\Realtek\Audio\` directory can place a malicious executable named `HDA.exe` (or `Audio.exe`, `Realtek.exe`, etc.) in that path. When the service starts (either at boot or manually), Windows will interpret the unquoted path and attempt to execute the attacker's planted binary instead of the legitimate RtkAudioService64.exe. Because the service runs as LocalSystem, the injected code gains the highest Windows privilege level.

The vulnerable component is the Realtek Audio Service (RtkAudioService64.exe) version 1.0.0.55. The service binary path is registered as `C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe` without surrounding quotes, which is the classic unquoted service path pattern.

The advisory does not provide a vendor patch. The remediation is to enclose the service binary path in double quotes (e.g., `"C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe"`) so that Windows treats the entire string as a single path and does not search for executables in intermediate directories. Without a patch from Realtek, users must manually correct the service path or apply appropriate access controls to prevent untrusted users from writing to the affected directories.