EUVD-2026-44730
GHSA-vgx6-wf36-3h9h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires local access and the ability to open the device as a low-privilege user (AV:L, PR:L, AC:L); unrestricted kernel I/O yields full C/I/A impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Pegatron Tdelo64.sys improperly exposes privileged hardware access functionality through the \\.\TdeIo device interface. IOCTL handlers including TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.
AnalysisAI
Local privilege escalation in Pegatron's Tdelo64.sys kernel driver allows any unprivileged user to perform arbitrary hardware I/O port reads and writes through the \\.\TdeIo device. The driver's TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE handlers lack authorization checks, letting a local attacker manipulate hardware registers to gain kernel-level control, tamper with firmware interfaces, or establish persistent low-level compromise. Reported by CERT/CC; no public exploit identified at time of analysis, and EPSS is low at 0.20% (10th percentile).
Technical ContextAI
Tdelo64.sys is a Windows kernel-mode driver shipped by Pegatron (a major ODM/OEM board and system manufacturer), exposing a device object at \\.\TdeIo. It provides an IOCTL interface whose INDEXIO handlers wrap the x86 IN/OUT port I/O instructions, giving callers direct access to legacy indexed I/O ports (used for chipset, Super I/O, and embedded controller configuration). Because kernel drivers execute in ring 0, any exposed primitive that reads or writes physical I/O ports effectively grants ring-0 hardware control to whoever can call it. The root cause is CWE-269 (Improper Privilege Management): the driver mediates a privileged operation but performs no access-control or caller-privilege validation before servicing the IOCTL, so a low-privilege user process inherits the driver's kernel-level hardware access. This is the classic 'vulnerable/exploitable driver' (BYOVD-relevant) pattern.
RemediationAI
No vendor-released patched driver version is identified at time of analysis, so remediation centers on removing or blocking the vulnerable driver. Consult the CERT/CC advisory at https://kb.cert.org/vuls/id/529388 for vendor guidance and any updated Tdelo64.sys build, and replace any Tdelo64.sys dated 02-17-2025 or earlier once a fixed version is published. As compensating controls: uninstall the Pegatron utility that installs Tdelo64.sys if it is not required (trade-off: loses the associated hardware/monitoring functionality); add the vulnerable driver hash to the Microsoft Vulnerable Driver Blocklist / enable HVCI and Windows Defender Application Control to prevent it from loading (trade-off: may block legitimate use of the tool and requires HVCI-compatible hardware); and restrict local/interactive logon and application execution on affected machines to limit who can reach the \\.\TdeIo device (trade-off: does not remove the flaw, only reduces the pool of potential local attackers). Standard EoP hardening - least privilege and blocking untrusted local code execution - reduces the practical attack surface since exploitation requires local access.
More in Tdelo64 Sys
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today