CVE-2026-20938
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
An untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could break VBS isolation, leading to privilege escalation and access to protected data.
Recommendation
Install the latest Windows security updates from Microsoft.
Other vulnerabilities in Windows VBS Enclave
See all- CVE-2026-83498High
Vulnerability involving untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave. Allows an authorized attacker to elevate privileges locally.
- CVE-2026-32220Medium
An improper access control vulnerability in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
Original NVD description (English source)
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.