CVE-2026-20876 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Share: View original

Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affect Windows Virtualization-Based Security (VBS) Enclave Four vulnerabilities have been identified in Windows Virtualization-Based Security (VBS) Enclave, allowing both authorized and unauthorized attackers to disclose information or elevate privileges locally. The vulnerabilities include untrusted pointer dereferences and a heap-based buffer overflow, impacting the security of systems utilizing VBS. Specific CVEs include CVE-2026-20819, CVE-2026-20938, CVE-2026-20876, and CVE-2026-20935. 4 sources 49

Extracted Entities

CVEs (1)

Platforms (1)

Vulnerabilities (1)

Windows Virtualization-Based Security (vbs) Enclave Elevation Of Privilege Vulnerability