Windows Server 2012 CVE-2026-27908

Local authenticated user access required. Exploitation requires triggering a race condition in Windows TDI Translation Driver (tdx.sys) kernel module. High complexity due to timing sensitivity of use-after-free vulnerability.

Real-world risk is moderate despite the 7.0 CVSS score. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local-only exploitation requiring low privileges but high attack complexity, meaning successful exploitation demands precise timing or race condition manipulation. The vulnerability requires an authenticated user context, significantly limiting attack surface compared to remote or unauthenticated flaws. No EPSS data provided, but the local attack vector typically correlates with lower exploitation probability in enterprise environments with proper access controls. No confirmed active exploitation (not present in CISA KEV), and no public exploit identified at time of analysis. From an SSVC perspective, technical impact is total (kernel-level privilege escalation), but automatable exploitation is unlikely due to AC:H complexity and requirement for authenticated local access. Priority should be elevated in environments with untrusted local users (shared workstations, terminal servers, multi-tenant systems) or where insider threat models apply. In hardened environments with strict user access controls and endpoint detection, this represents a lower immediate risk than remotely exploitable vulnerabilities.

An authenticated local user exploits a race condition in tdx.sys to trigger use-after-free, corrupting kernel memory and executing code with elevated SYSTEM privileges for privilege escalation.