CVE-2026-18767: Insufficient IOCTL access control allows local access to I/O ports
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems with the affected TcRouter.sys driver are exposed. Exploitation requires local access and low-privileged permissions; no user interaction is required.
What does an attacker need to exploit it?
An attacker or malicious local process needs the ability to run on the affected system with low privileges and invoke the driver’s exposed IOCTL function calls. The provided information does not indicate that remote access alone is sufficient.
What is the potential impact after exploitation?
The issue permits access to I/O ports through TcRouter.sys and can result in a full compromise of the affected device, affecting confidentiality, integrity, and availability.