CVE-2026-14961 Overview
CVE-2026-14961 is a kernel driver vulnerability in the Pegatron Tdelo64.sys driver. The driver exposes a privileged device interface at \\.\TdeIo that fails to restrict access to sensitive Input/Output Control (IOCTL) functionality. The IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. A local attacker can send crafted IOCTL requests to achieve arbitrary kernel memory read and write primitives. This weakness is categorized under [CWE-20: Improper Input Validation].
Critical Impact
Local attackers can escalate privileges to NT AUTHORITY\SYSTEM, bypass security products, steal credentials, or fully compromise affected Windows systems.
Affected Products
- Pegatron Tdelo64.sys kernel driver
- Windows systems where the vulnerable driver is loaded
- Any Bring Your Own Vulnerable Driver (BYOVD) scenario leveraging Tdelo64.sys
Discovery Timeline
- 2026-07-15 - CVE-2026-14961 published to the National Vulnerability Database (NVD)
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-14961
Vulnerability Analysis
The Tdelo64.sys driver registers a device object accessible through the \\.\TdeIo symbolic link. When a user-mode process opens this device and issues IOCTLs, the driver's dispatch routine directly acts on the supplied input buffer without confirming the caller's security context. The driver treats user-supplied pointers as trusted kernel addresses and performs read and write operations on them.
This design allows any local unprivileged process to invoke the driver's memory primitives. Because the driver runs in ring 0, the memory operations execute with full kernel privileges. Attackers use these primitives to modify kernel structures such as the EPROCESS token, replacing a process token with the SYSTEM token to achieve privilege escalation.
Root Cause
The root cause is twofold. First, the device object is created with a permissive Access Control List (ACL) that permits non-administrative users to open the interface. Second, the IOCTL handler performs no SeAccessCheck on the requester and no ProbeForRead/ProbeForWrite validation on caller-supplied addresses. This is a classic pattern seen in vulnerable OEM driver components repurposed as BYOVD tools.
Attack Vector
Exploitation requires local code execution on the target host with the driver already installed and loaded. The attacker opens a handle to \\.\TdeIo using CreateFileW, then issues DeviceIoControl calls with attacker-controlled IOCTL codes. Crafted input buffers instruct the driver to read from or write to arbitrary kernel virtual addresses. Attackers typically chain this into token replacement, disabling of endpoint protection callbacks, or ntoskrnl structure manipulation.
No verified public exploit code is referenced in the advisory. Technical details are available in the CERT Vulnerability Advisory #529388.
Detection Methods for CVE-2026-14961
Indicators of Compromise
- Presence of the file Tdelo64.sys on systems where Pegatron software is not required
- Creation of a handle to the device path \\.\TdeIo by non-vendor processes
- Loading of Tdelo64.sys via sc.exe create or service registry entries from unexpected paths such as user-writable directories
- Sudden process token elevation to SYSTEM from a previously medium-integrity process
Detection Strategies
- Monitor kernel driver load events (Windows Event ID 6, Sysmon Event ID 6) for Tdelo64.sys and correlate against known-good baselines
- Alert on DeviceIoControl handle opens to \\.\TdeIo from processes outside the vendor's expected image list
- Apply the Microsoft Vulnerable Driver Blocklist and detect attempts to install drivers matching known-vulnerable hashes
- Hunt for parent-child relationships where an unprivileged process spawns a SYSTEM process shortly after driver interaction
Monitoring Recommendations
- Enable Hypervisor-Protected Code Integrity (HVCI) and Attack Surface Reduction (ASR) rules that block abuse of vulnerable signed drivers
- Forward Sysmon driver-load, file-create, and process-creation telemetry to a centralized Security Information and Event Management (SIEM) platform
- Track unexpected changes to the Windows Defender status, endpoint sensor callbacks, and kernel callback registrations
How to Mitigate CVE-2026-14961
Immediate Actions Required
- Inventory all endpoints for the presence of Tdelo64.sys and remove the driver from systems where Pegatron functionality is not required
- Deploy the Microsoft recommended driver blocklist to prevent the driver from loading, even if reintroduced
- Restrict local administrator rights so attackers cannot install the driver as part of a BYOVD chain
- Ensure endpoint protection with kernel tamper protection is enabled and monitoring driver loads
Patch Information
No vendor patch information is referenced in the NVD entry at time of publication. Refer to the CERT Vulnerability Advisory #529388 for the latest vendor coordination status and any driver updates released by Pegatron.
Workarounds
- Block Tdelo64.sys at the kernel level using Windows Defender Application Control (WDAC) policies or the Microsoft Vulnerable Driver Blocklist
- Remove or rename the driver binary and delete its associated service registry key under HKLM\SYSTEM\CurrentControlSet\Services\
- Restrict access to \\.\TdeIo by revoking the device object's DACL where the driver must remain installed
# Enable the Microsoft Vulnerable Driver Blocklist (Windows 11 / Server 2022+)
# Settings > Windows Security > Device Security > Core Isolation > Microsoft Vulnerable Driver Blocklist: On
# Query for the driver service
sc.exe query TdeIo
# Stop and remove the service if present and not required
sc.exe stop TdeIo
sc.exe delete TdeIo
# Remove the driver file (run as Administrator)
del /f %SystemRoot%\System32\drivers\Tdelo64.sys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
