Privilege Elevation Vulnerability in Windows Virtualization-Based Security by Microsoft
CVE-2026-20938

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Windows 11 Version 25h2
Windows 11 Version 24h2
Windows 11 Version 22h3
Windows 11 Version 23h2
Vendor
CVE Published:
13 January 2026

What is CVE-2026-20938?

An untrusted pointer dereference vulnerability in Windows Virtualization-Based Security (VBS) Enclave enables a local unauthorized attacker to escalate privileges. This flaw can lead to unauthorized access to sensitive resources and potential system compromise. Users are advised to review security patches provided by Microsoft to protect against this vulnerability and secure their systems effectively.

Affected Version(s)

Windows 11 version 22H3 ARM64-based Systems 10.0.22631.0 < 10.0.22631.6491

Windows 11 Version 23H2 x64-based Systems 10.0.22631.0 < 10.0.22631.6491

Windows 11 Version 24H2 ARM64-based Systems 10.0.26100.0 < 10.0.26100.7623

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.