A use‑after‑free flaw in the Windows Virtualization‑Based Security (VBS) enclave can be triggered by an attacker who already has local access to the system. The flaw allows the attacker to manipulate memory after the object is freed, potentially leading to execution of arbitrary code with elevated privileges. This weakness corresponds to CWE-416 (Use After Free) and can result in a local privilege escalation that compromises system integrity and availability.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2016, Server 2019, Server 2022, and Server 2025, including their server core installations.

The vulnerability carries a CVSS score of 7, indicating a high severity for local attacks. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack requires authorized local access, so the threat is most significant to compromised or administrative users; remote exploitation is not feasible with the information provided.