CVE-2026-96914
8.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122, CWE-190
Impact
A local attacker with standard user privileges can escape or compromise the Virtualization-Based Security (VBS) enclave to gain elevated system privileges. They need existing local credentials or execution on the host to exploit it.
Root cause
An integer overflow or wraparound in the Windows VBS Enclave allows memory corruption across isolation boundaries.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for your specific Windows version from the MSRC advisory; no workaround is documented, so patch immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.