An use‑after‑free flaw in the TDI Translation Driver (tdx.sys) permits an authorized attacker with local access to gain elevated privileges. The vulnerability can be leveraged to execute code with higher rights, potentially reaching SYSTEM level, thereby compromising confidentiality, integrity, and availability of the affected system. While it does not enable remote code execution, any attacker who achieves local access can abuse the flaw to expand rights and perform malicious actions within the host.

The flaw affects a wide range of Microsoft Windows releases. Vulnerable systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1, 22H3, and 26H1; and the Windows Server line from 2012 and 2012 R2 through 2025. Both Server Core and full install variants are impacted where the TDI driver is present.

The CVSS v3.1 score of 7.0 marks this a high‑severity local privilege escalation. The EPSS value is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known active exploitation. Attack conditions require an attacker who already has local foothold or can trigger the driver load; no external network vector is indicated. The impact is limited to the compromised machine, but if the attacker controls a critical environment the wider threat is significant.