A privilege escalation vulnerability exists in the Pegatron tdeio64.sys driver. This issue stems from an unprotected IOCTL dispatch routine that fails to validate user requests. An unprivileged local attacker can exploit this to read and write arbitrary kernel memory. This ultimately allows them to gain NT AUTHORITY\SYSTEM privileges. The driver exposes the \.\TdeIo device interface for privileged IOCTL requests. It lacks adequate access control and validation of user-supplied memory addresses. Crafted DeviceIoControl requests can overwrite process tokens, leading to privilege escalation. Additionally, some IOCTLs allow direct interaction with hardware I/O ports, enabling hardware manipulation. Exploitation results in a complete system compromise, allowing credential extraction and rootkit installation. Currently, no vendor fix is available. Organizations should disable or remove the driver if not needed and consider security features like WDAC or HVCI.