TcRouter.sys: Local privilege escalation via arbitrary memory access (CVE-2026-18768)
A local low-privileged attacker can exploit the TcRouter.sys driver via exposed IOCTL function calls to access or remap arbitrary physical memory, resulting in full system compromise.
CVE search metadata
CVE search record: CVE-2026-18768. Severity: high. CVSS: 7.8. KEV: no. Product: TcRouter.sys. Brief: TcRouter.sys: Local privilege escalation via arbitrary memory access (CVE-2026-18768). Brief link: https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18768/
Triage facts
Revision 1- Applicability
- TcRouter.sys
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The TcRouter.sys driver contains a vulnerability (CVE-2026-18768) that allows local low-privileged users to interact with exposed IOCTL function calls. This flaw enables an attacker to access arbitrary physical memory or define memory mappings, which can be leveraged for full system compromise.
Impact
Successful exploitation allows a local user to escalate privileges to the kernel level, resulting in a full compromise of the affected device.
Recommendation
Prioritize identification of systems running the vulnerable TcRouter.sys driver and coordinate with the vendor to obtain and apply security updates. As the vulnerability involves kernel-mode driver exploitation, monitoring for unusual driver loads or IOCTL communication patterns originating from non-privileged processes is recommended.
Immediate actions
Inventory all systems for the presence of the TcRouter.sys driver
Threat Hunt
Identify processes attempting to open handles to TcRouter.sys and issuing unusual IOCTL codes
Data: Kernel object access monitoring, Endpoint Detection and Response (EDR) telemetry on driver communication
Mitigations
Apply security patches for TcRouter.sys as released by the manufacturer
CVE-2026-18768