CVE-2026-83501 – Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability

CVE-2026-83501 is an information disclosure vulnerability in Windows Virtualization-Based Security (VBS) Enclave caused by an out-of-bounds read. An authorized local attacker with low privileges could exploit the flaw without user interaction and potentially view Virtual Trust Level 1 (VTL1) data from Virtual Trust Level 0 (VTL0), the least privileged trust level.

CVSS Score: 5.5

SEVERITY: Critical

THREAT: The vulnerability threatens the confidentiality boundary between Windows Virtual Trust Levels. Successful exploitation could allow a low-privilege attacker operating in VTL0 to access data belonging to the more privileged VTL1 environment, exposing information that should remain isolated by VBS protections.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation More Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-83501 affects Windows Virtualization-Based Security Enclave and is caused by an out-of-bounds read. The flaw can allow software to read memory beyond its intended boundary, potentially exposing protected information across Windows trust levels. Exploitation is local, has low attack complexity, requires low privileges, and does not require user interaction. Microsoft states that successful exploitation could allow an attacker in VTL0 to view VTL1 data. The CVSS v3.1 metrics indicate high confidentiality impact, with no confirmed integrity or availability impact.

EXPLOITABILITY: The affected Microsoft product is Windows Virtualization-Based Security Enclave. Specific affected Windows versions are not confirmed in the available data. Exploitation requires local access with low privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could expose sensitive information protected within a higher-trust VBS environment. This may weaken security controls that depend on virtualization-based isolation and could reveal data useful for follow-on attacks. Organizations relying on VBS to protect sensitive workloads, credentials, or security-sensitive processes could face increased risk if affected systems remain unpatched.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should limit untrusted local code execution and restrict access to systems that depend heavily on VBS protections.

URGENCY: This vulnerability is rated Critical, and Microsoft assesses exploitation as More Likely. Although there is no confirmed active exploitation, the flaw can expose higher-trust VTL1 data to a lower-trust VTL0 context. Organizations using VBS protections should prioritize deployment of the official security update.