Summary
Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges would an attacker gain by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could potentially leak data from the target enclave or execute code within the context of the target enclave.
How could an attacker exploit this vulnerability?
A locally authenticated attacker could run a specially crafted application that submits a malicious report request to an affected VBS enclave. Successful exploitation could allow the attacker to execute code within the target enclave.
Security updates
10.0.17763.9376 — https://support.microsoft.com/help/5126651
Vulnerabilities 1
-
High 8.8
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
CWE added. Informational change only.
-
#1
Information published.
References
-
CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108471
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss