Windows VBS Enclave CVE-2026-83498

Exploitation requires an authenticated local user account (standard/low-privileged) on a Windows 11 or Windows Server 2025 system with VBS Enclave functionality present and active. The CVSS PR:L metric confirms a standard non-administrator session is sufficient; no elevated privileges are required as a precondition. No user interaction is needed (UI:N), and no non-default configuration beyond VBS being enabled is implied by the description. Limiting factors: the attacker must already possess local code execution as a low-privileged user - remote unauthenticated exploitation is not possible. Systems where VBS/Hyper-V is disabled at the firmware or Group Policy level, or where Enclave support is not present (older OS versions not listed in affected version data), are not reachable via this specific code path.

The CVSS 7.8 base score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the threat profile: exploitation is strictly local and requires a low-privileged authenticated session, which meaningfully limits the attack surface relative to network-exploitable vulnerabilities. However, AC:L confirms no special conditions beyond that session are needed, making the escalation path technically trivial once an attacker has a foothold. The complete C:H/I:H/A:H triad indicates that successful exploitation yields full system compromise. No CISA KEV listing and no public exploit code have been identified at time of analysis, moderating near-term mass-exploitation risk. EPSS probability data is absent from the available intelligence. The key risk multiplier is chaining: commodity malware routinely obtains low-privileged local sessions via phishing or RCE in other components, at which point a low-complexity local escalation like this becomes the critical second step to full device takeover. VBS Enclave is increasingly active by default on Windows 11 and Server 2025, broadening the attack surface across modern Windows deployments. Organizations running unpatched Windows 11 or Server 2025 endpoints should prioritize this patch within their standard remediation cycle.

An attacker who has gained a low-privileged local session - for example through a phishing-delivered initial-access payload or an unrelated web application RCE - crafts a malformed pointer value and passes it to the VBS Enclave interface on an unpatched Windows 11 or Server 2025 system. The enclave's trusted execution context dereferences the pointer without validation, enabling the attacker to corrupt privileged memory structures and escalate to SYSTEM. No public proof-of-concept has been identified, but the AC:L rating indicates a working exploit requires no special alignment or timing and could be developed by a skilled adversary.