Windows VBS Enclave CVE-2026-96914

Exploitation requires the attacker to already possess local, authenticated code-execution on the target host (CVSS PR:L, AV:L) and to reach the Windows Virtualization-Based Security (VBS) Enclave code path - so VBS must be enabled/in use on the system, which is the limiting factor. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The required prerequisite - an existing low-privileged foothold plus a VBS-enabled configuration - is what constrains realistic exploitation; this is a privilege-escalation primitive, not a remote entry point. Patched builds per EUVD must be absent (e.g., below 10.0.26100.33650 on Server 2025, below 10.0.26200.9711 on Windows 11 25H2).

This is a locally-exploitable elevation-of-privilege flaw with a provided CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (base 8.8), meaning low-complexity exploitation by an already-authenticated local user with no user interaction, and a changed scope reflecting that compromise of the VBS enclave crosses a trust boundary into the protected/secure environment. The signals are internally consistent but point to moderate rather than emergency priority: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' while rating Technical Impact as 'total', and the CVE is NOT in CISA KEV, with no public exploit identified at time of analysis - so the high score is driven by impact (full enclave compromise), not by demonstrated real-world exploitation. The AV:L/PR:L combination means an attacker must first obtain code execution as a local authenticated user, which materially limits mass exploitation but makes this a valuable second-stage/privilege-escalation primitive for an attacker who already has a foothold. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here; absence of EPSS/KEV/POC data should be treated as 'unknown', not as evidence of low risk.

An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) invokes the vulnerable VBS Enclave interface with crafted input that triggers an integer overflow leading to a heap buffer overflow (CWE-122). Because the CVSS scope is changed (S:C), successful exploitation escapes the normal process boundary and compromises the Virtualization-Based Security enclave, yielding full confidentiality, integrity, and availability impact. No public proof-of-concept exploit has been identified at time of analysis, and CISA SSVC currently rates exploitation status as 'none'.