Vulnerability · Published Jul 15, 2026 · Assigned by certcc
CVE-2026-14960CVE-2026-14960
Critical 9.8
In plain English
A critical-severity improper access control in Tdelo64.sys from Pegatron Corp.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pegatron Corp. | Tdelo64.sys | 02-17-2025 – through 02-17-2025 |
Weakness: CWE-284, CWE-668, CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H