Windows VBS Enclave CVE-2026-108471

Exploitation requires the attacker to already possess local, authenticated access with at least low privileges on the affected host (CVSS AV:L/PR:L) and the ability to invoke the Windows Virtualization-Based Security (VBS) Enclave interface - meaning VBS must be enabled/deployed on the target, which is standard on modern hardware-backed Windows but not universal on all legacy or VM configurations. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once local access exists. The principal limiting factors are the local-only vector (no remote network path), the requirement for pre-existing privileges, and dependence on VBS being active; these constrain realistic risk to post-compromise escalation rather than initial access.

Signals are moderately aligned toward a real but non-emergency priority. The CVSS 3.1 base score of 8.8 is driven largely by the scope change (S:C) and full triad impact (C:H/I:H/A:H), but the vector itself requires local access (AV:L) and existing privileges (PR:L), so this is a privilege-escalation primitive, not a remotely reachable flaw. CISA's SSVC framework corroborates lower urgency: Exploitation is rated 'none' (no observed exploitation) and Automatable is 'no', meaning it cannot be reliably mass-exploited, even though Technical Impact is 'total'. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC was referenced - so there is no evidence of active or imminent widespread exploitation. Net: this is a credible local EoP in a security-critical component (VBS Enclave) that should be patched on normal-to-expedited Patch Tuesday cadence, but it is not a drop-everything network-exploitable issue. One tag conflict to note: the input Tags include 'Information Disclosure', which contradicts the description (local privilege elevation) and the CWE-822 untrusted-pointer-dereference classification - treat the impact as elevation of privilege, not info disclosure.

An attacker who already has low-privilege code execution on a Windows 10 1809 or Windows Server 2019 host (e.g., via a compromised standard user account or a sandboxed process) invokes the vulnerable VBS Enclave interface with a crafted pointer value. Because the enclave dereferences an untrusted pointer (CWE-822), the attacker corrupts privileged state across the VBS trust boundary (S:C) to elevate to higher privileges. No public exploit identified at time of analysis, and CVSS AC:L indicates the trigger is not conditions-dependent once local access is obtained.