Executive brief
A security vulnerability exists in the Windows Virtualization-Based Security (VBS) Enclave, a feature designed to protect sensitive data and code in an isolated environment. An attacker who already has high-level administrative access to a system could exploit this flaw to further elevate their privileges or compromise the secure enclave. This could lead to the exposure of highly sensitive information that is normally shielded from the rest of the operating system.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists within the Microsoft Windows Virtualization-Based Security (VBS) Enclave. The flaw is triggered when the enclave improperly handles memory allocation on the heap, allowing an attacker to overwrite adjacent memory. To exploit this, an attacker must already possess high privileges (PR:H) on the local system. Successful exploitation allows the attacker to achieve local privilege escalation and potentially bypass security boundaries provided by the VBS isolation. Microsoft has released security updates to address this issue across affected versions of Windows 11 and Windows Server.
Affected products
- Microsoft Windows 11 Version 23H2 10.0.22631.0 to 10.0.22631.6491
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.7623
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.7623
- Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 to 10.0.25398.2092
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.32230
Timeline
- 2026-01-13: disclosed: Initial publication of the vulnerability details.
- 2026-07-30: patched: Microsoft updated the advisory with specific version information.