CVE-2026-108471: Local privilege escalation in Windows VBS Enclave · ZeroHour

CVE-2026-108471

mass

Local privilege escalation in Windows VBS Enclave

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 16, 2026

AI analysis

CVE-2026-108471 is an untrusted pointer dereference (CWE-822) in Microsoft Windows Virtualization-Based Security (VBS) Enclave. An attacker who is already authorized to run code locally can trigger the flaw without further user interaction and elevate privileges, with a changed security scope and high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). It affects Windows systems that include the VBS Enclave component; specific build numbers are not listed in the supplied advisory data and were covered in Microsoft's October 2026 Patch Tuesday updates. Microsoft is the assigning CNA. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 Patch Tuesday security updates for every supported Windows edition that includes Virtualization-Based Security (VBS) Enclave. Until updates are deployed, treat local accounts as a privilege boundary: restrict who can log on interactively, and review systems where VBS is enabled. No public workaround is described in the advisory data.

Affected

Microsoft Windows Virtualization-Based Security (VBS) Enclave

Affected Windows releases not enumerated in the advisory data; addressed in the October 2026 security updates

Estimated exposure

massHundreds of millions of Windows devices potentially in scope (exact VBS Enclave adoption unknown) — Windows is deployed on well over a billion endpoints, and VBS is widely available and often enabled on Windows 11 and recent Windows Server; the subset that actually uses VBS Enclave is not published, so this is an order-of-magnitude…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Weakness: CWE-184
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-108471

In the news1 stories

Microsoft Patch Tuesday, October 2026 Security Update Review