TcRouter.sys: Local privilege escalation via IOCTL (CVE-2026-18767)
A local low-privileged attacker or process can exploit exposed IOCTL function calls in the TcRouter.sys driver to access I/O ports and achieve full system compromise.
CVE search metadata
CVE search record: CVE-2026-18767. Severity: high. CVSS: 7.8. KEV: no. Product: TcRouter.sys. Brief: TcRouter.sys: Local privilege escalation via IOCTL (CVE-2026-18767). Brief link: https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18767/
Triage facts
Revision 1- Applicability
- TcRouter.sys
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-18767 is a vulnerability in the TcRouter.sys driver that permits unauthorized access to I/O ports. By leveraging exposed IOCTL function calls, a low-privileged local actor can escalate privileges, leading to full system compromise. The vulnerability has a CVSS v3.1 base score of 7.8.
Impact
Successful exploitation allows a local attacker or process to move from low-privilege access to full system compromise.
Recommendation
- Audit systems for the presence of the TcRouter.sys driver.
- Implement monitoring for processes interacting with the driver via DeviceIoControl calls.
- Prioritize patching if an updated driver version is released by the vendor.
Immediate actions
Identify all systems running the TcRouter.sys driver
Threat Hunt
Identify suspicious processes attempting to open handles to TcRouter.sys or using DeviceIoControl
Data: Endpoint telemetry (e.g., Sysmon Event ID 10 / ProcessAccess)
Mitigations
Monitor or restrict access to the TcRouter.sys device object until a vendor patch is deployed
CVE-2026-18767