Windows VBS Enclave CVE-2026-70097

Exploitation requires an attacker to already have authenticated low-privileged code execution on the local Windows host (AV:L, PR:L) and to successfully win a timing race in the VBS Enclave's shared-resource synchronization (AC:H), making success probabilistic rather than guaranteed. VBS/enclave functionality must be in use on the target for the vulnerable code path to be reachable. There is no remote vector and no user interaction, but the local-access requirement, the need for a non-trivial race win, and the non-automatable nature (per SSVC) substantially limit realistic exploitation; impact is confined to integrity/spoofing with no data disclosure or denial of service.

This is a genuinely low-to-moderate priority issue, and the multiple signals here are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N, base 5.6) describes a local-only attack requiring an already-authenticated low-privileged foothold on the machine and the winning of a timing race (AC:H), with no confidentiality or availability impact and only an integrity/spoofing effect against the VBS enclave trust boundary (S:C reflecting the crossing of that security boundary). CISA's SSVC framework aligns with a low-urgency posture: Exploitation=none (no observed or public exploitation), Automatable=no (the race condition cannot be reliably mass-exploited), and Technical Impact=partial. There is no CISA KEV listing and no public POC reported in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS was not provided and therefore cannot be cited. The one notable data discrepancy: the input Tags include 'Information Disclosure,' but both the CVE description ('perform spoofing') and the CVSS vector (C:N, I:H) indicate an integrity/spoofing weakness rather than confidentiality loss - the 'Information Disclosure' tag appears mislabeled and should not drive triage. Net: a real but low-severity local spoofing flaw that warrants routine patching, not emergency response.

A low-privileged but authenticated local user (for example, malware or a standard account already present on a Windows host) repeatedly triggers a timing-sensitive operation in the VBS Enclave to win a race window in the shared-resource synchronization. On success they spoof trusted state across the enclave boundary, undermining the integrity guarantees VBS is meant to enforce. No public exploit code is identified at time of analysis, and the high attack complexity and non-automatable nature make reliable exploitation difficult.