The Pegatron tdeio64.sys driver exposes an unprotected IOCTL dispatch routine that does not validate the origin or permissions of user-supplied requests. This allows an unprivileged local attacker to send crafted DeviceIoControl requests to perform arbitrary kernel memory read and write operations. By overwriting the current process token with the SYSTEM token, the attacker can escalate privileges to NT AUTHORITY\SYSTEM. Additionally, the driver exposes IOCTLs that allow direct hardware I/O port interactions, potentially enabling manipulation of hardware resources beyond normal OS protections. Successful exploitation can lead to complete OS compromise, including bypassing security controls, credential theft from protected processes, rootkit installation, and kernel data structure manipulation. No official patch or fix is available at the time of publication.

Exploitation grants arbitrary kernel memory read/write capabilities and SYSTEM-level privileges. This enables attackers to bypass or disable endpoint security, extract sensitive credentials, install persistent rootkits, and manipulate kernel and hardware resources, resulting in a full compromise of the affected Windows system.

No vendor-supported fix is currently available. Organizations should disable or remove the vulnerable tdeio64.sys driver if it is not required. Prevent untrusted users from loading or interacting with the driver. Implement Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) where supported to block loading of known vulnerable drivers.