Jan 2026: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2026-20938 Published on January 13, 2026
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Weakness Type
Untrusted Pointer Dereference
The program obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Products Associated with CVE-2026-20938
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-20938 are published in these products:
Affected Versions
Microsoft Windows 11 version 22H3:- Version 10.0.22631.0 and below 10.0.22631.6491 is affected.
- Version 10.0.22631.0 and below 10.0.22631.6491 is affected.
- Version 10.0.26100.0 and below 10.0.26100.7623 is affected.
- Version 10.0.26200.0 and below 10.0.26200.7623 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.