PT-2026-2737 · Microsoft · Vbs Enclave+2

Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-20935

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows Virtualization-Based Security (VBS) Enclave (affected versions not specified)

Description An issue exists in Windows Virtualization-Based Security (VBS) Enclave where an untrusted pointer dereference can allow an attacker to disclose information locally. This impacts the confidentiality of data within the enclave.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

BDU:2026-00406

CVE-2026-20935

Affected Products

Vbs Enclave

Windows

Windows Virtualization-Based Security

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-20935 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20935 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20935 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20935 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20935 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00406 · Security Note
• https://twitter.com/CVEnew/status/2011181507134787897 · Twitter Post