TVicPort EUVD-2026-26240

TVicPort64.sys driver version 5.2.1.0 must be installed and loaded on the target Windows x64 system. Attacker requires existing local access with at least low-privileged user credentials (PR:L) - this is NOT remote exploitation. The vulnerability cannot be exploited over the network without first obtaining local interactive or service account access through separate compromise vectors. No user interaction is required once local access is established (UI:N). Standard Windows installations do not include TVicPort by default, limiting exposure to environments that explicitly deployed this third-party hardware I/O driver for debugging, legacy hardware support, or specialized industrial/embedded applications. Systems without TVicPort installed are not vulnerable regardless of other factors.

This vulnerability presents moderate-to-high real-world risk in environments where TVicPort is deployed. The CVSS 7.8 score accurately reflects the severe impact (complete system compromise) balanced against the local attack vector requirement. EPSS data is not provided, but the combination of public exploit code availability (GitHub gist reference) and straightforward exploitation (AC:L) makes this readily weaponizable by attackers with existing low-privilege access. CISA SSVC assessment indicates 'Exploitation: none' and 'Automatable: no' with 'Technical Impact: total' - this suggests while not currently exploited in the wild or suitable for worm-like propagation, the vulnerability enables complete local system takeover. The lack of KEV listing and EPSS score suggests limited evidence of widespread exploitation, but the POC availability significantly lowers the barrier for targeted attacks. Primary risk scenarios include insider threats, post-compromise lateral movement after initial access via phishing/malware, and privilege escalation in environments where TVicPort is installed for hardware debugging or legacy application support. Organizations not using TVicPort face zero risk; those using it should treat this as high-priority given the trivial escalation path from any low-privilege account to SYSTEM.

An attacker who has gained initial access to a Windows system via phishing, stolen credentials, or social engineering obtains a standard low-privilege user account. Discovering TVicPort64.sys version 5.2.1.0 installed on the target system (common in manufacturing, hardware testing, or legacy application environments), the attacker downloads the public exploit code from the referenced GitHub gist. By executing the exploit, they send a specially crafted IOCTL 0x80002008 request to the kernel driver, which fails to properly validate the input. The driver processes the malicious request in kernel mode with SYSTEM privileges, allowing the attacker to execute arbitrary code at the highest privilege level, install persistent backdoors, disable security software, access sensitive data across all user profiles, and move laterally to other network systems using newly acquired SYSTEM credentials.