CVE-2026-85921

CVE-2026-85921 is a double free flaw (CWE-415) in Windows Secure Kernel Mode, the hypervisor-based component that underpins Virtualization-Based Security (VBS) on Windows clients and servers. It is triggered locally by an already-authorized attacker who holds high privileges on the machine (per the CVSS vector, privileges required: high), and successful exploitation lets them elevate privileges across a security boundary — escaping the isolation that Secure Kernel is meant to enforce — with high impact on confidentiality, integrity, and availability. In practice, an attacker with administrative code execution on a VBS-enabled host could leverage the bug to break out of or subvert the secure-kernel boundary and gain deeper, SYSTEM/hypervisor-adjacent control of the system. Any Windows deployment running Secure Kernel Mode (i.e., with VBS/HVCI or Hyper-V-based isolation enabled) is in scope. As of this writing there is no known public proof of concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply the Microsoft security update covering this CVE to all VBS/HVCI-enabled Windows clients and servers as soon as it is available, prioritizing servers and privileged workstations where admins and service accounts already hold elevated rights. Because exploitation requires an attacker who already has high local privileges, enforce least-privilege account policies, restrict local administrator membership, and monitor for anomalous activity from privileged processes around virtualization components. After patching, verify VBS/HVCI remains enabled and healthy (e.g., via msinfo32 or Get-CimInstance -ClassName Win32_DeviceGuard) to confirm the secure-kernel protections are intact.