Windows VBS Enclave CVE-2025-53717

Exploitation requires the attacker to already have local, low-privileged code execution on an affected Windows 11 host (PR:L, AV:L) and to interact with the Virtualization-Based Security (VBS) Enclave feature, supplying untrusted input to a security decision the enclave makes (CWE-807). Limiting factors that reduce realistic risk: VBS/enclave functionality must be present and in use on the host; the attack requires no user interaction (UI:N) but carries HIGH attack complexity (AC:H), indicating a race condition, precise timing, or a specific state the attacker must win and cannot deterministically control; and because this is a local escalation it cannot be reached remotely or by an unauthenticated actor. It affects Windows 11 versions 22H2 through 25H2.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a local privilege-escalation flaw in the Windows Virtualization-Based Security (VBS) Enclave rooted in reliance on untrusted inputs in a security decision (CWE-807). Every signal points to limited mass-exploitation risk: attack vector is LOCAL (AV:L), attack complexity is HIGH (AC:H) implying a race, timing, or specific state the attacker cannot reliably control, and the attacker must already hold LOW privileges (PR:L) - so this is a post-compromise escalation step, not an initial access vector. These intrinsic limiters are corroborated by the exploitation signals: EPSS is only 0.35% (27th percentile), the CVE is NOT on the CISA KEV list, and no public PoC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record was supplied in the input, so automatability and exploitation-maturity cannot be assessed from a formal framework. The one notable data conflict: the input Tags label this 'Information Disclosure,' but the NVD description and the C:H/I:H/A:H impact clearly describe privilege ELEVATION - treat the 'Information Disclosure' categorization as mislabeled rather than authoritative. Net: real fix-worthy defense-in-depth weakness in a VBS security boundary, but AC:H plus local-authenticated prerequisites plus low EPSS make it a routine-patch-cycle item rather than an urgent widespread-exploitation threat.

An attacker who has already achieved low-privileged local code execution on a Windows 11 host (for example via a phishing payload or a compromised standard user account) feeds crafted untrusted input into a security decision made by the VBS Enclave, winning the high-complexity condition to cross the enclave trust boundary and elevate to higher privileges. No public exploit code is referenced, and the high attack complexity means exploitation is not point-and-click reliable.