rtsupx.sys

RtsUpx.sys is a kernel driver from Realtek, bundled with the user-mode utilities that ship alongside Realtek USB audio and card-reader hardware on consumer motherboards and laptops. If the Realtek-branded utilities for USB devices are installed, this driver is where that software reaches down to the hardware.

It is on the public LOLDrivers list for the 2021 Realtek cluster: CVE-2021-36925 (arbitrary physical-memory read and write), CVE-2021-36923 (privileged IN/OUT instructions), CVE-2021-36924 (pool memory handling), and CVE-2021-36922 (USB device access). The vulnerable range runs from version 1.13.0.0 through 1.14.0.0. The access the driver was built for — direct talk to USB device hardware — is the access the vulnerable builds expose to any local caller.

Why it persists: as with most BYOVD targets, the fix is in a newer Realtek release, but the older signed binary still loads on modern Windows. Updating the Realtek software does not remove the older driver from a machine that previously installed it. Microsoft's Vulnerable Driver Blocklist covers known-bad builds when the feature is enabled.

If you have Realtek-branded USB hardware, update the Realtek drivers from your motherboard or laptop OEM's current support page. If you do not and the driver is present anyway, identify which installed utility placed it there and uninstall it.

rtsupx.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.