CVE-2026-14960 Overview
CVE-2026-14960 is a driver vulnerability affecting the Pegatron Tdelo64.sys kernel driver. The driver exposes privileged hardware access functionality through the \\.\TdeIo device interface without proper authorization checks. IOCTL handlers TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes. Local attackers can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, or establish persistent low-level compromise.
Critical Impact
A local unprivileged attacker can perform arbitrary hardware I/O port reads and writes, enabling firmware tampering, system instability, and persistent low-level system compromise.
Affected Products
- Pegatron Tdelo64.sys kernel driver
- Systems shipped with the vulnerable Pegatron driver installed
- Any Windows host where the \\.\TdeIo device interface is accessible
Discovery Timeline
- 2026-07-15 - CVE-2026-14960 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-14960
Vulnerability Analysis
The Pegatron Tdelo64.sys driver runs in Windows kernel mode and exposes a device object at \\.\TdeIo. Any process, including those running as unprivileged users, can open a handle to this device. The driver processes IOCTL requests without validating the caller's privilege level or the requested operation's safety.
Two IOCTL handlers stand out. TDE_IOCTL_INDEXIO_READ reads from arbitrary hardware I/O ports specified by the caller. TDE_IOCTL_INDEXIO_WRITE writes attacker-controlled data to arbitrary I/O ports. Both operations execute in ring 0 with full kernel privileges, giving user-mode callers direct hardware access that Windows normally restricts.
This pattern falls under driver vulnerability and broken access control classes. It follows the well-documented "bring your own vulnerable driver" (BYOVD) attack pattern, where signed drivers are abused as primitives for privilege escalation and defense evasion.
Root Cause
The root cause is missing authorization on the device object and its IOCTL dispatch routines. The driver does not verify that callers hold administrative privileges before executing hardware I/O operations. The \\.\TdeIo device DACL permits access from low-integrity processes, and no per-IOCTL access checks compensate for this exposure.
Attack Vector
An unprivileged local process opens \\.\TdeIo using CreateFile. The attacker then issues DeviceIoControl calls specifying TDE_IOCTL_INDEXIO_READ or TDE_IOCTL_INDEXIO_WRITE, supplying target I/O port numbers and data payloads. The driver executes the corresponding in or out CPU instructions on behalf of the caller.
Attackers can chain these primitives to reprogram Super I/O chips, interact with SMBus and embedded controllers, manipulate BIOS/UEFI-adjacent hardware state, or corrupt platform firmware. Refer to the CERT Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2026-14960
Indicators of Compromise
- Presence of Tdelo64.sys in C:\Windows\System32\drivers\ or loaded via sc create from user-writable paths
- Handles to the \\.\TdeIo device object opened by non-administrative processes
- Unexpected service registrations referencing the Pegatron driver on non-Pegatron hardware
Detection Strategies
- Enumerate loaded kernel drivers and flag Tdelo64.sys on systems that do not require Pegatron platform tooling
- Monitor for CreateFile calls targeting \\.\TdeIo originating from unsigned or unusual binaries
- Apply Microsoft's vulnerable driver blocklist and enable Hypervisor-Protected Code Integrity (HVCI) to detect load attempts
Monitoring Recommendations
- Audit kernel driver load events (Event ID 6, Sysmon Event ID 6) for the driver's file hash and signature
- Track DeviceIoControl telemetry against known-vulnerable IOCTL codes where EDR telemetry supports it
- Alert on service creation for kernel drivers dropped into world-writable directories or user profile paths
How to Mitigate CVE-2026-14960
Immediate Actions Required
- Identify all systems with Tdelo64.sys installed and remove the driver from hosts that do not require Pegatron platform utilities
- Enable the Microsoft vulnerable driver blocklist through Windows Defender Application Control or Smart App Control
- Restrict local administrative access to reduce the population of users who can install or load the driver
Patch Information
No vendor patch is referenced in the enriched CVE data. Consult the CERT Vulnerability Advisory for the latest vendor coordination status and remediation guidance from Pegatron.
Workarounds
- Uninstall the Pegatron utility that ships Tdelo64.sys when platform management features are not required
- Deploy HVCI and Memory Integrity to block loading of drivers matching Microsoft's recommended blocklist
- Apply Windows Defender Application Control (WDAC) policies that deny execution of the driver by hash or signer
# Configuration example
# Query for the vulnerable driver and remove its service
sc.exe query TdeIo
sc.exe stop TdeIo
sc.exe delete TdeIo
del /f %SystemRoot%\System32\drivers\Tdelo64.sys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
