CVE-2026-20938
Published: 13 January 2026
Summary
CVE-2026-20938 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and timely correction of system flaws like the untrusted pointer dereference in VBS Enclave via patching to prevent local privilege escalation.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate untrusted pointer dereference vulnerabilities in security enclaves like VBS.
Enforces least privilege to restrict low-privileged local attackers' access to necessary resources, limiting the potential impact of VBS Enclave privilege escalation exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Untrusted pointer dereference in VBS Enclave directly enables local privilege escalation via exploitation of a security isolation mechanism.
NVD Description
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-20938 is an untrusted pointer dereference vulnerability, classified under CWE-822, in the Windows Virtualization-Based Security (VBS) Enclave. This flaw affects Windows systems that utilize VBS Enclave for enhanced security isolation. Published on 2026-01-13, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized local attacker with low privileges. Exploitation requires only local access and low complexity, with no user interaction needed. Successful attacks enable local privilege escalation, granting high-level impacts on confidentiality, integrity, and availability.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20938.
Details
- CWE(s)