CVE-2026-14960
CVE-2026-14960

Currently unrated

Key Information:

Vendor: Pegatron Corp.
Status: Tdelo64.sys
Vendor: CVE Published:; 15 July 2026

🔔 Create Pegatron Corp. Vulnerability Alert

What is CVE-2026-14960?

Pegatron Tdelo64.sys improperly exposes privileged hardware access functionality through the \\.\TdeIo device interface. IOCTL handlers including TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.

Affected Version(s)

Tdelo64.sys 02-17-2025

References

https://kb.cert.org/vuls/id/529388

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 15, 2026
Vulnerability Reserved
Jul 7, 2026

CVE-2026-14960 Data

JSON