The vulnerability arises from inadequate encryption strength used within Windows Virtualization-Based Security enclaves. Because of this weak cryptographic protection, an attacker who already has authorized local access could imitate a legitimate enclave, causing the system to accept forged enclave communications. This spoofing could undermine authentication checks inside the enclave and allow the attacker to perform unauthorized actions limited to the enclave’s environment, without elevating privileges beyond the local scope.

Microsoft Windows 11 versions 24H2, 25H2, 26H1, and 26H2, including ARM64 and x64 variants, as well as Windows Server 2022 and Windows Server 2025 (both standard and Server Core installations), are affected according to the CNA vendor/product list and the CPE identifiers.

With a CVSS score of 5.6 the impact is moderate, and an EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, signifying no known public exploitation. The documentation indicates the attack vector requires local authorized access; no remote exploitation path has been documented, thus the threat is confined to users with administrative or elevated local privileges.