Pegatron tdeio64.sys driver flaw enables SYSTEM access
Unpatched Pegatron tdeio64.sys driver lets local attackers abuse IOCTL dispatch to gain arbitrary kernel read/write and escalate to SYSTEM.
CERT/CC disclosed two vulnerabilities in Pegatron's tdeio64.sys Windows driver, a WDM driver providing low-level hardware I/O access via the \\.\TdeIo device interface. The driver fails to validate the origin or permissions of user-supplied IOCTL requests, allowing an unprivileged local attacker to send crafted DeviceIoControl calls that grant arbitrary kernel memory read and write primitives. CVE-2026-14961 covers the memory read/write escalation path, which can be leveraged to overwrite a process token with the SYSTEM token, achieving NT AUTHORITY\SYSTEM privileges. CVE-2026-14960 covers exposed IOCTLs that permit direct hardware I/O port manipulation beyond normal OS protections.
Successful exploitation gives an attacker full kernel-level compromise: disabling or bypassing endpoint security, dumping credentials from protected processes like lsass.exe, installing persistent rootkits, and manipulating kernel structures. This is a classic "bring your own vulnerable driver" (BYOVD) scenario, where a signed but flawed driver is loaded to escalate privileges and evade detection.
No vendor-supported fix is currently available. CERT/CC recommends removing or disabling the driver where not needed, restricting untrusted users from interacting with it, and using Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) with vulnerable driver blocklists to prevent it from loading.
Mentioned in this report
Detection guidance
Vulnerable Pegatron tdeio64.sys Driver Loaded
Detects the signed-but-vulnerable Pegatron tdeio64.sys WDM driver being loaded into the kernel, a required BYOVD precursor step before the DeviceIoControl exploitation primitives can be used. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Vulnerable Pegatron tdeio64.sys Driver Loaded
description: Detects loading of the Pegatron tdeio64.sys driver (CVE-2026-14960/14961),
which lacks IOCTL origin validation and can be abused for arbitrary kernel read/write,
token overwrite to SYSTEM, and lsass credential dumping. Loading of this driver
outside of Pegatron OEM utility contexts is a strong BYOVD indicator.
tags:
- attack.privilege-escalation
- attack.defense-evasion
- attack.t1068
logsource:
category: driver_load
product: windows
detection:
selection:
ImageLoaded|endswith: \tdeio64.sys
condition: selection
falsepositives:
- Legitimate Pegatron/OEM hardware diagnostic or monitoring utilities that ship and
load this driver on supported systems
level: high
id: c589e9d5-2871-5e6f-b22e-dd234e5a6618
status: experimental
author: Vorant
Service Creation Registering tdeio64.sys Kernel Driver
Detects creation of a Windows service pointing its ImagePath at tdeio64.sys, the mechanism an attacker uses to get the vulnerable signed driver loaded (bring-your-own-vulnerable-driver). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Service Creation Registering tdeio64.sys Kernel Driver
description: Detects registration of a new Windows service whose binary path references
tdeio64.sys. Attackers create/register the driver as a kernel service (sc.exe create
or direct registry write) to get the vulnerable Pegatron driver loaded so its unauthenticated
IOCTLs can be reached via \\.\TdeIo.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\
TargetObject|endswith: \ImagePath
Details|contains: tdeio64.sys
condition: selection
falsepositives:
- OEM-supplied installer for legitimate Pegatron hardware diagnostic software on systems
where the driver is a supported dependency
level: high
id: 9b6debf8-2262-569f-b86b-5cd596b85412
status: experimental
author: Vorant
Process Accessing LSASS Memory Following Kernel Driver Exploitation Context
Detects a process obtaining high-privilege memory-read access to lsass.exe, consistent with credential dumping enabled after SYSTEM-level compromise via the tdeio64.sys kernel read/write primitive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Accessing LSASS Memory Following Kernel Driver Exploitation Context
description: Detects processes requesting memory-read-capable access rights to lsass.exe.
In the tdeio64.sys BYOVD scenario, an attacker who has overwritten their process
token to SYSTEM via the driver's kernel read/write primitive can then open lsass.exe
directly (bypassing normal protected-process/PPL restrictions) to dump credentials.
Generalises on the GrantedAccess pattern rather than any specific tool name.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: \lsass.exe
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x1438'
- '0x143a'
- '0x1f1fff'
filter_known_tools:
SourceImage|endswith:
- \MsMpEng.exe
- \wmiprvse.exe
- \werfault.exe
- \dumpservice.exe
condition: selection and not filter_known_tools
falsepositives:
- Endpoint security or crash-dump utilities that legitimately open lsass.exe with
broad access rights
- EDR agents performing memory scanning of lsass.exe
level: medium
id: 7ea0d506-ceb7-5394-aa40-ddf0965a115b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/529388
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free