An untrusted pointer dereference inside the Windows Virtualization-Based Security (VBS) enclave permits an attacker who already has local access to gain higher privileges on the affected system. The flaw allows the malicious code to read or write memory locations that should only be accessible to privileged components, potentially enabling arbitrary code execution with elevated rights. This directly compromises confidentiality, integrity, and availability on the compromised host.

The vulnerability affects Microsoft Windows 10 Version 1809 and Microsoft Windows Server 2019, including Server Core installations, where the VBS enclave component is deployed.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is less than 1%, indicating that active exploitation is statistically unlikely, yet the damage potential remains significant. The vulnerability requires local access; an attacker who can execute code or gain user-level privileges on the machine can exploit it to gain administrative rights. The flaw is not listed in the CISA KEV catalog, indicating no documented exploits are known at this time.