An untrusted pointer dereference within Windows Virtualization-Based Security (VBS) enclaves permits an authorized attacker to elevate privileges on a local system. This flaw exploits the enclave’s memory handling to bypass security checks, enabling the attacker to gain higher privileges, potentially compromising system integrity and confidentiality. The weakness is identified as CWE-822, reflecting improper validation of user-controlled data before dereferencing.

Microsoft Windows 11 is affected in its 23H2, 24H2, 25H2, and 22H3 releases. The vulnerability spans both x64 and ARM64 architectures for these build versions.

The CVSS score of 7.8 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The flaw is not cataloged in CISA’s Known Exploited Vulnerabilities list, implying no publicly available exploits at the moment. Nevertheless, the local attack vector requires an authorized attacker—such as a user with foothold or existing local access—to trigger the pointer attack, potentially leading to full privilege escalation on the compromised machine.