EUVD-2026-22446
GHSA-x23f-9g5c-6qmp
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free in Windows TDI Translation Driver (tdx.sys) allows local privilege escalation to SYSTEM by authenticated low-privileged users on Windows 10/11 and Server 2012-2025. Microsoft has released security updates addressing this CWE-416 memory corruption flaw across all supported Windows versions. CVSS 7.0 reflects high attack complexity but full system compromise if successfully exploited. No public exploit identified at time of analysis, though the vulnerability's local attack vector an
Technical ContextAI
The TDI (Transport Driver Interface) Translation Driver (tdx.sys) is a kernel-mode component in Windows that provides backward compatibility for legacy TDI-based network drivers by translating their calls to the modern Windows Filtering Platform (WFP) and Winsock Kernel (WSK) interfaces. This CWE-416 use-after-free vulnerability occurs when the driver improperly manages object lifetime in memory, allowing a pointer to reference already-freed memory. An attacker with low-privilege local access can trigger this condition through crafted system calls or IOCTLs, potentially causing the kernel to execute attacker-controlled data from the freed memory region. The vulnerability affects Windows kernel security boundaries, as tdx.sys operates at ring 0 with full system privileges. The affected CPE strings span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025) including Server Core installations.
RemediationAI
Apply Microsoft security updates immediately through Windows Update or WSUS to patch the vulnerable tdx.sys driver. Fixed versions: Windows 10 1607/Server 2016 build 10.0.14393.9060 or later, Windows 10 1809/Server 2019 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Server 2012 build 6.2.9200.26026 or later, Server 2012 R2 build 6.3.9600.23132 or later, Server 2022 build 10.0.20348.5020 or later, and Server 2022 23H2 build 10.0.25
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today