PT-2026-60232 · Pegatron · Tdelo64.Sys

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-14961

NVD

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Pegatron Tdelo64.sys exposes a privileged device interface, .TdeIo, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to NT AUTHORITYSYSTEM, security product bypass, credential theft, or complete system compromise.

Correção

Improper Privilege Management

RCE

Enumeração de Fraquezas

CWE-269

CWE-20

Identificadores relacionados

CVE-2026-14961

Produtos afetados

Tdelo64.Sys

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-14961 · Nota de Segurança
• https://reddit.com/r/SecOpsDaily/comments/1uxdmrx/vu529388_privilege_escalation_vulnerability_via · Publicação no Reddit
• https://kb.cert.org/vuls/id/529388 · Nota