CVE-2026-14961

{
  "id": "CVE-2026-14961",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T18:16:44.640",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\\\.\\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\\SYSTEM`, security product bypass, credential theft, or complete system compromise."
    },
    {
      "lang": "es",
      "value": "Pegatron ’Tdelo64.sys’ expone una interfaz de dispositivo privilegiada, ’\\\\.\\TdeIo’, que no restringe adecuadamente el acceso a la funcionalidad IOCTL sensible. El despachador IOCTL del controlador no valida los privilegios del llamador ni verifica las direcciones de memoria del kernel proporcionadas por el usuario antes de realizar operaciones de memoria. Al enviar solicitudes manipuladas a IOCTL, un atacante local puede lograr operaciones arbitrarias de lectura y escritura en la memoria del kernel, lo que lleva a la escalada de privilegios a ’NT AUTHORITY\\SYSTEM’, eludir productos de seguridad, robo de credenciales o compromiso total del sistema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Pegatron Corp.",
          "product": "Tdelo64.sys",
          "versions": [
            {
              "version": "02-17-2025",
              "lessThanOrEqual": "02-17-2025",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T19:30:44.030568Z",
          "id": "CVE-2026-14961",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/529388",
      "source": "[email protected]"
    }
  ]
}