Microsoft Fixes Windows Elevation-of-Privilege Flaws in tdx.sys and DWM Core

Microsoft published security updates for multiple Windows elevation-of-privilege vulnerabilities affecting the TDI Translation Driver (tdx.sys) and the DWM Core Library. The disclosures include CVE-2026-27908 and CVE-2026-27921 in tdx.sys, CVE-2026-25189 in the DWM Core Library, and an earlier related TDI Translation Driver issue, CVE-2025-49659. Microsoft classified the flaws as local privilege-escalation bugs that could let an authenticated attacker gain higher privileges on a vulnerable system.

Microsoft said CVE-2026-27908 is a use-after-free vulnerability tracked as CWE-416 with a CVSS 3.1 score of 7.0, and warned exploitation is more likely despite requiring high attack complexity because the attacker must win a race condition. The company stated the issue was not publicly disclosed and not exploited in the wild at publication, and credited Angelboy (@scwuaptx) of DEVCORE for reporting it. Fixes were made available through the Microsoft Security Update Guide for all listed vulnerabilities.