The vulnerability is an untrusted pointer dereference inside the Windows Virtualization‑Based Security (VBS) Enclave. It allows an authorized attacker to bypass a protected security feature that operates locally. This flaw is classified as a CWE‑822 security feature bypass. No other information is provided about additional exploitation capabilities such as privilege escalation or remote code execution.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3 and 26H1, and Windows Server editions 2016, 2019, 2022, 2025 and 23H2. The flaw applies to x86, x64 and ARM64 architectures as noted in the vendor’s correction list.

The CVSS score of 5.7 indicates a moderate severity. EPSS information is not available, so the current exploitation probability cannot be quantified. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the vulnerability requires an authorized local attacker to target a VBS enclave, it is a local attack vector. The risk is moderated by the fact that the flaw bypasses a security feature rather than enabling arbitrary code execution, but the impact of disabling or weakening a security control warrants timely remediation.