The Tdelo64.sys driver from Pegatron Corp. improperly restricts access to its IOCTL handlers, including TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE, which are accessible via the \\.\TdeIo device interface. These handlers allow unprivileged user-mode processes to perform arbitrary hardware I/O port operations without authorization checks. This lack of access control (CWE-284) enables local attackers to manipulate hardware registers, interfere with firmware-related interfaces, cause system instability, or establish persistent low-level compromises. The vulnerability is identified as CVE-2026-14960 with a CVSS 3.1 base score of 9.8, indicating critical severity.

Successful exploitation allows a local attacker to bypass privilege restrictions and perform arbitrary hardware I/O operations. This can result in unauthorized hardware register manipulation, firmware tampering, system instability, and potentially persistent compromise at a low system level. The impact affects confidentiality, integrity, and availability (all rated high).

No official patch or remediation has been published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/529388 for current remediation guidance. Until a fix is available, restrict local access to systems running the vulnerable driver to trusted users only, as exploitation requires local access.