CVE-2026-20938: Windows 11 23h2 Privilege Escalation

CVE-2026-20938 Overview

CVE-2026-20938 is a local privilege escalation vulnerability in the Windows Virtualization-Based Security (VBS) Enclave. The flaw stems from an untrusted pointer dereference [CWE-822] that an authorized attacker can exploit to elevate privileges on affected Windows 11 systems. Microsoft assigned a CVSS 3.1 base score of 7.8 and rated the issue HIGH severity. The vulnerability affects Windows 11 versions 23H2, 24H2, and 25H2 on both x64 and ARM64 architectures. Successful exploitation compromises the integrity guarantees that VBS Enclaves provide for isolated user-mode code and data.

Critical Impact
A local, authorized attacker can dereference an untrusted pointer inside a VBS Enclave to gain elevated privileges and undermine isolation boundaries protecting sensitive code and secrets.

Affected Products

Microsoft Windows 11 23H2 (x64, ARM64)
Microsoft Windows 11 24H2 (x64, ARM64)
Microsoft Windows 11 25H2 (x64, ARM64)

Discovery Timeline

2026-01-13 - CVE-2026-20938 published to NVD
2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-20938

Vulnerability Analysis

Virtualization-Based Security (VBS) Enclaves use hypervisor-enforced isolation to protect sensitive code and data from the normal Windows kernel. Code running inside an enclave operates in a higher trust boundary called Virtual Trust Level 1 (VTL1). The vulnerability allows an authorized local attacker to cause the enclave to dereference an attacker-influenced pointer that should not be trusted. Operating on an untrusted pointer inside the protected execution context lets the attacker read, write, or redirect execution to memory locations of their choosing. The result is privilege elevation that breaks the isolation guarantee VBS is designed to enforce.

Root Cause

The root cause is classified under [CWE-822]: Untrusted Pointer Dereference. The enclave code accepts a pointer value supplied or influenced by lower-privileged code without validating that the pointer references memory the enclave is authorized to access. When the enclave dereferences this pointer, it performs operations on memory chosen by the attacker. This validation gap exists at the trust boundary between VTL0 callers and VTL1 enclave logic.

Attack Vector

The attack vector is local and requires the attacker to already hold low-privilege authenticated access to the target system. The attacker invokes the enclave entry points and supplies crafted pointer values through the parameters or shared memory regions used to communicate with the enclave. The enclave then dereferences the malicious pointer during its normal processing path. No user interaction is required. Microsoft has not reported public exploitation, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept exploit is available at the time of publication. Refer to the Microsoft Security Update CVE-2026-20938 for additional technical details.

Detection Methods for CVE-2026-20938

Indicators of Compromise

Unexpected processes loading or interacting with VBS Enclave host modules from non-standard paths.
Crashes or bug checks referencing securekernel.exe or enclave host processes that may indicate exploitation attempts.
Local processes spawning higher-integrity children without a documented elevation event in security logs.

Detection Strategies

Hunt for unsigned or recently-introduced binaries calling enclave APIs such as CallEnclave or LoadEnclaveImage.
Correlate kernel error events (Event ID 41, bug check codes related to secure kernel) with process activity from the same user session.
Baseline legitimate enclave-using applications in the environment and alert on deviations.

Monitoring Recommendations

Enable Windows Defender Application Control and audit secure kernel events to catch anomalous enclave loads.
Forward Microsoft-Windows-Kernel-General and Microsoft-Windows-Hyper-V-Hypervisor logs to a centralized analytics platform.
Monitor for privilege escalation telemetry such as new SeDebugPrivilege grants or token manipulation following enclave interactions.

How to Mitigate CVE-2026-20938

Immediate Actions Required

Apply the January 2026 Microsoft security update referenced in the Microsoft Security Update CVE-2026-20938 advisory across all Windows 11 23H2, 24H2, and 25H2 endpoints.
Inventory systems that rely on VBS Enclaves and prioritize patching for hosts handling sensitive workloads.
Restrict local logon and interactive access on multi-user systems until patching is complete.

Patch Information

Microsoft published the fix through the Microsoft Security Response Center (MSRC) update guide. Administrators should deploy the cumulative update for the corresponding Windows 11 build through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune. Validate installation by confirming the updated build number on each endpoint after reboot.

Workarounds

No vendor-supplied workaround removes the vulnerability without the patch; apply the update as the primary remediation.
Reduce exposure by enforcing least privilege so fewer accounts can execute code that interacts with VBS Enclaves.
Use application allowlisting to block untrusted binaries from invoking enclave APIs on production systems.

bash

# Verify the installed Windows build and confirm patch deployment
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, OsHardwareAbstractionLayer
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10