Vulnerability

CERT-In Vulnerability Note CIVN-2026-0025
Privilege Escalation Vulnerability in Windows Virtualization-Based Security (VBS) Enclave

Original Issue Date:January 16, 2026

Severity Rating: HIGH

Software Affected

The following Windows Virtualization-Based Security (VBS) have been affected:

Windows Server 2025 (Server Core installation) 10.0.26100.x and prior
Windows Server 2025 10.0.26100.x and prior
Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.x and prior
Windows 11 Version 25H2 10.0.26200.x and prior
Windows 11 Version 24H2 10.0.26100.x and prior
Windows 11 Version 23H2 10.0.22631.x and prior
Windows 11 Version 22H3 10.0.22631.x and prior

Overview

A vulnerability has been reported in Microsoft Windows Virtualization-Based Security (VBS) Enclave which may allow a local attacker to elevate privileges and compromise system security boundaries.

Target Audience:
Individuals and organizations using the above-mentioned Microsoft Windows operating systems with Virtualization-Based Security (VBS) Enclave enabled.

Risk Assessment:
High risk of privilege escalation, security bypass, and system compromise on affected Windows systems.

Impact Assessment:
Elevation of privileges, compromise of system integrity, unauthorized access, and potential security bypass.

Description

Microsoft Windows is a widely used operating system that provides core system services, application support, and advanced security features for both personal and enterprise environments. Microsoft Windows implements Virtualization-Based Security (VBS) to isolate sensitive system components within secure enclaves backed by hardware virtualization.

This vulnerability exists due to a heap-based buffer overflow in the VBS Enclave component. An authorized local attacker with elevated privileges can exploit this flaw to corrupt memory within the enclave, leading to unintended behavior and privilege escalation beyond intended security boundaries.

Successful exploitation of this vulnerability may allow an attacker to elevation of privileges, compromise of system integrity, unauthorized access, and potential security bypass.

Solution

Apply the security updates released by Microsoft:
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20876

Vendor Information

Microsoft
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20876

References

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20876

CVE Name
CVE-2026-20876

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India