The vulnerability is an integer overflow or wraparound in the Windows Virtualization-Based Security (VBS) enclave. An attacker with local access can exploit this flaw to elevate their privileges, potentially gaining full system control. The bug falls under CWE-122 (Buffer Overflow) and CWE-190 (Integer Overflow), indicating that overflow handling in enclave memory management is flawed. The impact is localized privilege escalation, allowing an authorized user to perform actions beyond their intended permissions.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2016, Server 2019, Server 2022, Server 2025 (including server core installations). These systems rely on VBS to isolate processes and are vulnerable when the feature is enabled.

The CVSS score is 8.8, designating a high severity. No EPSS score is publicly available, so the likelihood of exploitation is uncertain, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; a compromised or malicious local user must trigger the overflow to gain elevated privileges. External actors cannot exploit this via network traffic, but insider threats or compromised credentials that provide local access pose a significant risk.