Information Disclosure Vulnerability in Windows Virtualization-Based Security by Microsoft
CVE-2026-20935
6.2MEDIUM
Key Information:
- Vendor
Microsoft
- Vendor
- CVE Published:
- 13 January 2026
What is CVE-2026-20935?
An untrusted pointer dereference vulnerability exists in Windows Virtualization-Based Security (VBS) Enclave, which may allow an unauthorized attacker to gain access to sensitive information locally. This issue stems from improper handling of memory pointers, leading to potential information leakage within the secure environment. To mitigate this risk, users are advised to apply the latest security updates as provided by Microsoft.
Affected Version(s)
Windows 11 version 22H3 ARM64-based Systems 10.0.22631.0 < 10.0.22631.6491
Windows 11 Version 23H2 x64-based Systems 10.0.22631.0 < 10.0.22631.6491
Windows 11 Version 24H2 ARM64-based Systems 10.0.26100.0 < 10.0.26100.7623
References
CVSS V3.1
Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved