A local privilege escalation vulnerability in the Windows TDX component poses a significant security risk by allowing unauthorized users to gain elevated system permissions.

This is a buffer over-read vulnerability (CWE-126) within the TDX.sys driver. An attacker must have local access and valid user credentials to trigger this flaw, which subsequently allows them to elevate their privileges to a higher level of control.

Successful exploitation of this vulnerability allows an attacker to bypass standard operating system security controls, potentially leading to full system compromise. Given the CVSS score of 7.8, this is a high-severity issue that could result in unauthorized access to sensitive data, installation of persistent malicious software, or further movement within the network environment.

Immediate Action: Apply the relevant security updates provided by Microsoft in the November 2025 patch cycle to all affected Windows endpoints.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected privilege escalation events occurring shortly after user login.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced across all user accounts to minimize the potential impact should a local account be compromised.

Public Exploit Available: No

Organizations should prioritize the deployment of the official Microsoft security updates as part of their standard patch management cycle. Because this vulnerability facilitates privilege escalation, failure to remediate could allow an attacker with limited access to achieve total system control, making rapid patching essential for maintaining the integrity of the computing environment.