The vulnerability is an untrusted pointer dereference that occurs inside the Windows Virtualization-Based Security (VBS) enclave. When an authorized local attacker triggers the failure on a system running the affected Windows 11 versions, the flaw allows the reader to access memory that should be protected by the enclave. This results in local information disclosure. The weakness is classified as CWE‑822, indicating an insecure pointer dereference that can leak data.

The flaw affects Microsoft Windows 11 operating systems, including the 22H3, 23H2, 24H2, and 25H2 releases. Both ARM64 and x64 architectures are impacted, as reflected in the listed CPE entries.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires local authorized access to the target machine; the attacker must be able to execute code within the VBS enclave context. Once triggered, the attacker can read the content of the enclave’s memory, exposing any sensitive data residing there. The attack vector is therefore local, and no network or remote exploitation is possible.