CVE-2026-14961

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\SYSTEM`, security product bypass, credential theft, or complete system compromise.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/529388

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Pegatron ’Tdelo64.sys’ expone una interfaz de dispositivo privilegiada, ’\\.\TdeIo’, que no restringe adecuadamente el acceso a la funcionalidad IOCTL sensible. El despachador IOCTL del controlador no valida los privilegios del llamador ni verifica las direcciones de memoria del kernel proporcionadas por el usuario antes de realizar operaciones de memoria. Al enviar solicitudes manipuladas a IOCTL, un atacante local puede lograr operaciones arbitrarias de lectura y escritura en la memoria del kernel, lo que lleva a la escalada de privilegios a ’NT AUTHORITY\SYSTEM’, eludir productos de seguridad, robo de credenciales o compromiso total del sistema.

Information

Published : 2026-07-15 18:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-14961

Mitre link : CVE-2026-14961

CVE.ORG link : CVE-2026-14961

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-269

Improper Privilege Management

{"id": "CVE-2026-14961", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14961", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T19:30:44.030568Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Pegatron Corp.", "product": "Tdelo64.sys", "versions": [{"status": "affected", "version": "02-17-2025", "versionType": "custom", "lessThanOrEqual": "02-17-2025"}]}]}], "published": "2026-07-15T18:16:44.640", "references": [{"url": "https://kb.cert.org/vuls/id/529388", "source": "cret@cert.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\\\.\\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\\SYSTEM`, security product bypass, credential theft, or complete system compromise."}, {"lang": "es", "value": "Pegatron \u2019Tdelo64.sys\u2019 expone una interfaz de dispositivo privilegiada, \u2019\\\\.\\TdeIo\u2019, que no restringe adecuadamente el acceso a la funcionalidad IOCTL sensible. El despachador IOCTL del controlador no valida los privilegios del llamador ni verifica las direcciones de memoria del kernel proporcionadas por el usuario antes de realizar operaciones de memoria. Al enviar solicitudes manipuladas a IOCTL, un atacante local puede lograr operaciones arbitrarias de lectura y escritura en la memoria del kernel, lo que lleva a la escalada de privilegios a \u2019NT AUTHORITY\\SYSTEM\u2019, eludir productos de seguridad, robo de credenciales o compromiso total del sistema."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "cret@cert.org"}