Pegatron Tdelo64.sys CVE-2026-14960

Exploitation requires local access to a Windows system on which the vulnerable Pegatron Tdelo64.sys driver (build 02-17-2025 or earlier) is installed and loaded, and the ability to run code as any user that can open the \\.\TdeIo device object. The specific trigger is issuing the TDE_IOCTL_INDEXIO_READ or TDE_IOCTL_INDEXIO_WRITE IOCTLs, which the driver services without any authorization or caller-privilege check. Limiting factors: the attacker must first have local code execution (no remote/network path despite the AV:N score in the input, which contradicts the 'local attacker' description), and the machine must actually have the Pegatron driver present - typically only Pegatron-manufactured or Pegatron-utility-equipped hardware, which bounds real-world exposure. No user interaction or prior elevated privileges are required beyond the ability to open the device.

Signals conflict and must be reconciled. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) indicates remote, unauthenticated exploitation, but the description explicitly describes a LOCAL attacker abusing a device IOCTL - this is a local elevation-of-privilege issue, not a network-reachable one, so the AV:N scoring appears incorrect and should be treated as AV:L/PR:L; verify with the vendor/CERT-CC advisory. Adjusting for the real local vector, this is a genuine ring-0 EoP with total technical impact (SSVC: Technical Impact total, Automatable yes), meaning reliable exploitation once local code execution is achieved. However EPSS is low (0.20%, 10th percentile), SSVC Exploitation is 'none', and there is no KEV listing and no identified POC, so this is a high-severity capability with no evidence of active or widespread exploitation yet. Priority: real and meaningful for hardened/high-value endpoints (arbitrary port I/O = full kernel compromise and firmware tampering), but not an emergency patch-tonight item absent exposure or exploit availability. The Automatable=yes plus total impact means that if a POC emerges it could be weaponized quickly.

An attacker who already has an unprivileged foothold on the host (via phishing, a compromised low-priv service, or a malicious insider) opens a handle to \\.\TdeIo and issues TDE_IOCTL_INDEXIO_WRITE/READ calls to read and write arbitrary hardware I/O ports. Using this ring-0 primitive they disable security protections, tamper with firmware/EC registers, or plant a persistent low-level implant, escalating from user to full kernel control. No public POC is currently identified, but SSVC rates the technique automatable with total technical impact.