This vulnerability is caused by a race condition arising from concurrent execution using a shared resource in Windows Virtualization-Based Security (VBS). The improper synchronization allows an authorized local attacker to spoof the VBS enclave, effectively impersonating other processes or components within the same system. The impact is limited to local privileges; an attacker who already has some level of access can elevate or alter the behavior of virtual enclaves, potentially bypassing security controls designed for isolation and integrity.

The vulnerability affects Microsoft Windows 11 versions 24H2, 25H2, 26H1, 26H2 (for both x64 and arm64 architectures) and Microsoft Windows Server 2022, Windows Server 2025, and Windows Server 2025 Server Core installations. Users of these operating systems should verify that the latest security updates have been applied to mitigate the race condition.

With a CVSS score of 5.6, the vulnerability represents a moderate risk. The EPSS score is currently unavailable, and the vulnerability has not been listed in CISA's KEV catalog. The likely attack vector is local; an attacker must be able to run code with sufficient privileges to target the VBS enclave. While the exploitation requires authorized access, the impact of successful spoofing could compromise the integrity of trusted processes within the enclave. The risk of exploitation is considered moderate, but remediation through patching is strongly recommended.