Critical Windows Vulnerability in TDX.sys Driver Exposes Systems to Local Attacks

A significant security flaw, identified as CVE-2025-49658, has been discovered in the Windows Transport Driver Interface (TDI) Translation Driver (TDX.sys), posing a threat to the security of local systems. This vulnerability, an out-of-bounds read, could allow an authenticated local attacker to disclose sensitive information from the kernel memory.

The vulnerability resides within the TDX.sys driver, a core component of the Windows networking stack. The issue stems from the driver's failure to properly validate the length of a buffer before copying memory to it. This oversight can be exploited by a specially crafted application, enabling an attacker with local access to read beyond the intended memory boundaries.

Impact of the Vulnerability

Successful exploitation of CVE-2025-49658 could lead to the disclosure of sensitive kernel-level information. This information, while not directly allowing for remote code execution, could be invaluable for an attacker to bypass security mitigations like Address Space Layout Randomization (ASLR). By obtaining details about the kernel's memory layout, an attacker could then leverage this information to facilitate further attacks, potentially leading to privilege escalation.

The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a base score of 5.5, categorizing it as "Medium" severity. The vector string, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicates that the attack is local, requires low privileges, and has no user interaction. The primary impact is on confidentiality, which is rated as high.

It is important to distinguish this vulnerability from another flaw in the same driver, CVE-2025-49659, which is a more severe elevation of privilege vulnerability.

Mitigation and Recommendations

Microsoft has addressed this vulnerability by releasing a security update that corrects how the TDX.sys driver validates buffer lengths. System administrators and users are strongly urged to apply this patch as soon as possible to protect their systems. The update is available through standard channels like Windows Update.

In addition to installing the security update, organizations should adhere to security best practices, including:

  • Restricting local access: Limiting who can physically and locally access systems to only authorized personnel.
  • Implementing the principle of least privilege: Ensuring users and applications only have the permissions necessary to perform their functions.
  • Monitoring system activity: Keeping an eye on system logs for any unusual or suspicious behavior that might indicate an attempted exploit.

At present, there are no known instances of this vulnerability being actively exploited in the wild. However, given the nature of the flaw, prompt patching is the most effective way to mitigate the risk.