CVE-2026-14960

CRITICAL

Pegatron Tdelo64.sys < 02-17-2025 - Unauthenticated Arbitrary Hardware I/O Port Read and Write via IOCTL Handlers

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-14960. PoCs published by FzRsLLaSheR.

AI-analyzed exploit summary Detailed technical analysis of two privilege escalation vulnerabilities (CVE-2026-14960 and CVE-2026-14961) in Pegatron's TdeIo64 driver (tdeio64.sys). The writeup explains improper access control and arbitrary kernel memory read/write primitives, enabling local SYSTEM privilege escalation and unrestricted hardware I/O port access.

Description

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.

Exploits (1)

nomisec WRITEUP
by FzRsLLaSheR · poc
https://github.com/FzRsLLaSheR/CVE-2026-14960-CVE-2026-14961

Detailed technical analysis of two privilege escalation vulnerabilities (CVE-2026-14960 and CVE-2026-14961) in Pegatron's TdeIo64 driver (tdeio64.sys). The writeup explains improper access control and arbitrary kernel memory read/write primitives, enabling local SYSTEM privilege escalation and unrestricted hardware I/O port access.

Classification
Writeup 99%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Pegatron TdeIo Driver (tdeio64.sys)
Auth required
Prerequisites: Local access to a system with the vulnerable tdeio64.sys driver loaded · Low-privilege user context
mistral-large-3 · analyzed Jul 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0048
EPSS Percentile 38.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269 CWE-284 CWE-668
Status published
Products (1)
Pegatron Corp./Tdelo64.sys 02-17-2025
Published Jul 15, 2026
Tracked Since Jul 15, 2026