EUVD-2026-44731
GHSA-qm48-7h7g-j5m2
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Arbitrary kernel write enables SYSTEM token escalation (S:C, I:H, A:H); device interface accessible without any privileges (PR:N).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Pegatron Tdelo64.sys exposes a privileged device interface, \\.\TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to NT AUTHORITY\SYSTEM, security product bypass, credential theft, or complete system compromise.
AnalysisAI
Privilege escalation to NT AUTHORITY\SYSTEM is achievable on Windows systems hosting the Pegatron Tdelo64.sys kernel-mode driver, which exposes the \\.\TdeIo device interface without enforcing caller privilege checks or validating user-supplied kernel memory addresses in its IOCTL dispatcher. Any local user can open the device interface and send crafted IOCTL requests to perform arbitrary kernel memory read and write operations, enabling full system compromise including credential theft and security product bypass. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was reported to CERT/CC (VU#529388), and the provided CVSS score of 6.2 materially understates the real-world impact given the described kernel write capability.
Technical ContextAI
The Pegatron Tdelo64.sys is a Windows kernel-mode driver produced by Pegatron Corporation (an ODM and hardware manufacturer), identified by CPE cpe:2.3:a:pegatron_corp.:tdelo64.sys. The driver exposes a named device interface, \\.\TdeIo, which is accessible to unprivileged local users due to the absence of access controls. The vulnerability is rooted in CWE-20 (Improper Input Validation): the IOCTL dispatcher commits two distinct failures - it does not verify whether the calling process holds an elevated privilege token, and it passes user-supplied memory addresses directly into kernel memory operations without sanitization or bounds validation. This is a well-documented Windows driver vulnerability class where insufficient IOCTL input handling creates a direct and controllable bridge between user-mode and ring-0 kernel memory. Arbitrary kernel memory writes of this type classically enable token-stealing privilege escalation by overwriting the EPROCESS security token of the attacker's process.
RemediationAI
Consult the CERT/CC advisory at https://kb.cert.org/vuls/id/529388 for official vendor guidance and any available patch. No specific patched version number was identified in the available data - patch availability and exact fix version must be confirmed directly with Pegatron Corporation or through the CERT/CC disclosure. Where the driver is not functionally required, removing or disabling Tdelo64.sys from the system eliminates the attack surface entirely; however, this may break hardware functionality dependent on the driver. As a compensating control, administrators can tighten the discretionary access control list (DACL) of the \\.\TdeIo device object to restrict access to SYSTEM and Administrators only, preventing standard users from opening the interface - note that this may disrupt legitimate driver operation and should be validated in a test environment before deployment. Kernel-level telemetry via ETW or an EDR agent with driver visibility can provide detection coverage for anomalous IOCTL calls to \\.\TdeIo if remediation is delayed.
More in Tdelo64 Sys
View allSame weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today