CVE-2026-20938CWE-822

CVE-2026-20938

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

⚡ An untrusted pointer dereference in Windows VBS Enclave could let an authorized attacker level up their privileges locally — and that's not game over yet! 🎮 Think of it like a guest in a hotel who finds a way to access the master key, granting them entry to any room — suddenly, they can snoop through sensitive files and data. It's a major breach of trust! If an attacker exploits this vulnerability, they could gain unauthorized access to critical system functions, potentially altering configurations and compromising sensitive information. This could lead to severe data leaks or unauthorized modifications, sending shockwaves through the security landscape! ⚠️

Put simply

Think of it like a guest in a hotel who finds a way to access the master key, granting them entry to any room — suddenly, they can snoop through sensitive files and data. It's a major breach of trust! This vulnerability occurs due to an untrusted pointer dereference in the Windows Virtualization-Based Security (VBS) Enclave, allowing a local attacker to escalate their privileges without adequate safeguards in place.

What to do

If an attacker exploits this vulnerability, they could gain unauthorized access to critical system functions, potentially altering configurations and compromising sensitive information. This could lead to severe data leaks or unauthorized modifications, sending shockwaves through the security landscape! ⚠️ To secure your systems, ensure you apply the latest security updates from Microsoft, closely monitor systems for unauthorized access, and conduct regular privilege audits. Keeping your environment patched is essential! 🔒 You've got this! With the right steps, you can fortify your defenses and keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.4th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-01-13T23:16Z
Affected products (6)
ProductVersionsFixed in
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
    cvelistv5