CVE-2026-14961

Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\SYSTEM`, security product bypass, credential theft, or complete system compromise.

• CWE-20
• CWE-269

• https://kb.cert.org/vuls/id/529388

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14955The Checkout Field Editor for WooCommerce (Pro) plugin for W…6.5
• CVE-2026-14956The Bricksforge plugin for WordPress is vulnerable to Privil…9.8
• CVE-2026-14958IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a rem…7.2
• CVE-2026-14959IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a rem…7.2
• CVE-2026-1496Vulnerable versions of Coverity Connect lack an error handle…9.3
• CVE-2026-14960Pegatron `Tdelo64.sys` improperly exposes privileged hardwar…9.8
• CVE-2026-14966BBOT's unarchive module rejects archives containing symlink …3.1
• CVE-2026-14967BBOT's `github_workflows` module could be induced to write a…3.1
• CVE-2026-14969A flaw was found in 389-ds-base where the LDBM backend attri…4.4
• CVE-2026-1497Incorrect resolving of namespaces in composite databases in …7.2
• CVE-2026-14971IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.…7
• CVE-2026-14973IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for d…9.3