Vulnerability · Published Jul 15, 2026 · Assigned by certcc
CVE-2026-14961CVE-2026-14961
Medium 6.2
In plain English
A medium-severity privilege mismanagement in Tdelo64.sys from Pegatron Corp.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\SYSTEM`, security product bypass, credential theft, or complete system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pegatron Corp. | Tdelo64.sys | 02-17-2025 – through 02-17-2025 |
Weakness: CWE-269, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N