CVE-2026-108130: Heap buffer overflow in Windows VBS Enclave · ZeroHour

CVE-2026-108130

mass

Heap buffer overflow in Windows VBS Enclave

CVSS 3.1

7.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 13, 2026

AI analysis

CVE-2026-108130 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Virtualization-Based Security (VBS) Enclave. An attacker who is already authorized locally can trigger the flaw without user interaction and elevate privileges on the same system, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). It was disclosed by Microsoft in the October 2026 Patch Tuesday security updates. Specific affected version ranges are not listed in the provided data. It is not on CISA's Known Exploited Vulnerabilities list, and no public proof-of-concept is known.

What to do: Apply Microsoft's October 2026 Patch Tuesday security updates for the affected Windows builds as soon as they are available in your update channel. Until patched, limit local accounts that can interact with VBS Enclaves and monitor for unexpected privilege changes on systems where Virtualization-Based Security is enabled.

Affected

Microsoft Windows Virtualization-Based Security (VBS) Enclave

—

Estimated exposure

massOn the order of hundreds of millions of Windows installations that include VBS (exact vulnerable set unknown) — Windows 10, Windows 11, and supported Windows Server releases that ship VBS are deployed at very large scale; public OS market-share figures imply hundreds of millions of systems that can include this component, though the exact vulnerable…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Weakness: CWE-122
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-108130

In the news1 stories

Microsoft Patch Tuesday, October 2026 Security Update Review