Pegatron Tdelo64.sys CVE-2026-14961

The Pegatron Tdelo64.sys driver must be installed and actively loaded on the target Windows system, and the \\.\TdeIo device interface must be reachable by non-privileged users - the vulnerability exists precisely because this access restriction is absent. The CVSS vector PR:N confirms that no authentication, elevated token, or specific privilege is required; any local user account capable of executing code on the host is sufficient. Exploitation is strictly limited to local access (AV:L) - remote exploitation is not possible without first obtaining a local foothold through a separate vulnerability. No non-default configuration, specific hardware feature flag, or unusual deployment mode is required beyond the driver being present and loaded. Exploitation is limited to Pegatron-manufactured systems or OEM hardware that ships with this driver.

The provided CVSS 3.1 base score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is materially inconsistent with the described impact. The description explicitly states that the driver permits arbitrary kernel memory write operations enabling privilege escalation to SYSTEM, security product bypass, and complete system compromise - impacts that require I:H and A:H at minimum, and a Changed scope (S:C) given that kernel-level control affects all processes on the system rather than just the driver's own context. The official CVSS assignment should be treated as underscored and not used as the primary risk signal. No EPSS score or CISA KEV status was provided in the available data, so exploitation probability and confirmed in-the-wild activity cannot be quantified from these signals. Despite the moderate published score, the realistic operational risk is significantly elevated: any standard user account on an affected Pegatron system can achieve full SYSTEM-level kernel control with low complexity and no prior privileges. The absence of confirmed POC code or KEV listing prevents further exploitation likelihood assessment, but the attack complexity is inherently low for an attacker familiar with Windows kernel IOCTL exploitation techniques.

A local attacker with a standard user account on a Windows system running the Pegatron Tdelo64.sys driver opens the \\.\TdeIo device interface, which requires no elevated privileges, then sends a crafted IOCTL request containing a controlled kernel memory address. The driver performs a write operation at the attacker-supplied address without validation, enabling the attacker to overwrite the EPROCESS security token of their own process, escalating to NT AUTHORITY\SYSTEM and subsequently disabling endpoint security callbacks before conducting credential theft or lateral movement. No public exploit code has been confirmed in the available data, though the technique is well-understood in Windows kernel exploitation literature.