This vulnerability is a time‑of‑check time‑of‑use race condition in Windows Virtualization‑Based Security (VBS) Enclave that permits an authorized local attacker to bypass a security guardrail held by the enclave. The flaw allows a locally privileged user to manipulate timing in order to defeat the enclave’s core integrity checks, which could lead to elevated privileges. The weakness is classified as a race condition attack.

Affected systems include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2019 (full and core), Windows Server 2022, and Windows Server 2025 (full and core).

The CVSS score of 4.4 signals a moderate impact; potential exploitation requires a local, authorized attacker and a successful timing attack to leak or alter enclave state. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits. The likely attack vector is a local privileged user able to manipulate timing of enclave operations, so the risk is primarily confined to systems with VBS Enclave enabled and with sufficient local credentials.