Windows VBS Enclave EUVD-2026-100449

Exploitation requires the attacker to already hold authenticated, low-privilege local code execution on an affected host (PR:L, AV:L) - it cannot be triggered remotely and needs no user interaction (UI:N). The target must be running an unpatched build within the affected ranges: Windows 11 24H2/25H2/26H1/26H2 or Windows Server 2025 (including Server Core) below the fixed build numbers (e.g., <10.0.26100.9711 for 24H2, <10.0.26100.33650 for Server 2025). The limiting factor is the local-access prerequisite: an attacker with no foothold on the machine cannot reach the VBS Enclave interface, so realistic risk concentrates in environments where untrusted or semi-trusted users can run code locally.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a local, low-complexity privilege-escalation flaw that requires an attacker to already have authenticated low-privilege code execution on the host - it is not remotely reachable. The 7.8 (High) score is driven entirely by the total impact triad (C:H/I:H/A:H), which aligns with the SSVC 'Technical Impact: total' rating and the nature of a VBS Enclave compromise. However, the exploitation signals argue against urgent prioritization: CISA SSVC lists 'Exploitation: none' and 'Automatable: no', there is no KEV listing, no EPSS score was provided, and no public exploit was identified in the input. The signals are therefore internally consistent - high technical impact but no evidence of real-world exploitation and no automation path - making this a standard patch-cycle item rather than a drop-everything issue, with elevated importance for multi-tenant or shared-host environments where local low-privilege access by untrusted users is plausible. Note: no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the data.

An attacker who has already obtained low-privilege authenticated code execution on a Windows 11 or Server 2025 host (e.g., via a standard user account or a compromised low-integrity process) triggers the heap-based buffer overflow in the VBS Enclave to corrupt memory and elevate to higher privileges, undermining the virtualization-based security boundary. Because the CVSS vector is AV:L/AC:L with no user interaction, exploitation is reliable and requires no victim involvement once local access exists. No public proof-of-concept was identified at the time of analysis.