The vulnerability is a race condition in the Windows TDI Translation Driver (tdx.sys) that allows an authorized local attacker to elevate their privileges. Improper synchronization of a shared resource leads to an improper state that can be exploited to gain higher privileges. This weakness, identified as CWE-362 and CWE-416, can compromise confidentiality, integrity and availability by permitting an attacker with some local access to execute code with SYSTEM rights.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1, as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 Server edition. Both Server Core installations and full desktop editions are affected across x86, x64 and ARM64 architectures where the tdx.sys driver is present.

The CVSS score of 7 indicates high severity, and the EPSS score of 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in KEV, but the Microsoft update indicates that it is actively addressed. The attack requires local, authorized access to the target machine, making it a local privilege escalation vector. Operators should treat this as a priority update to prevent potential elevation of privileges by malicious scripts or applications running under user context.