Windows VBS Enclave EUVD-2026-100365

Exploitation requires that Windows Virtualization-Based Security (VBS) with Enclaves is enabled and in use on the target host - a feature present on modern Windows but not active in every deployment. The attacker must already have local, authenticated low-privilege code execution (PR:L, AV:L) and must reliably win a race-condition timing window (CWE-362), which is the primary limiting factor reflected by AC:H. No user interaction is needed (UI:N). Limiting factors: local access only (not remotely reachable), a pre-existing low-privilege foothold, the requirement that VBS Enclaves be configured, and the inherent unreliability of hitting the race window.

This is a moderate-priority local privilege escalation rated CVSS 7.0 (High) by Microsoft. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: exploitation is local (AV:L), requires an attacker who already holds low privileges (PR:L), needs no user interaction (UI:N), and yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) within an unchanged scope. The key risk-limiting factor is high attack complexity (AC:H), which is expected for a CWE-362 race-condition-driven use-after-free - the attacker must reliably win a timing window, making weaponization non-trivial. No EPSS score, SSVC decision data, KEV listing, or POC indicator was provided in the input; there is therefore no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a credible local EoP worth patching on a normal Microsoft Patch-Tuesday cadence, but the local-only vector plus high complexity and absence of exploitation signals mean it is not an emergency drop-everything issue. Note a tag/impact tension: the input carries a 'Denial Of Service' tag, yet the description and C:H/I:H impacts describe privilege elevation, not DoS - treat the DoS characterization with caution and verify against the MSRC advisory.

A low-privileged local user or a process that has already gained a foothold on a Windows host with VBS Enclaves in use repeatedly triggers a timing-sensitive operation to win a race condition in the VBS Enclave, causing a use-after-free. By controlling the freed object's reuse, the attacker corrupts enclave state to execute code in a higher-privileged context and elevate privileges. No public proof-of-concept was identified at time of analysis, and the high attack complexity (AC:H) means exploitation requires repeated attempts to hit the race window.