This vulnerability, tracked as CVE-2026-23670 and classified under CWE-822 (Untrusted Pointer Dereference), affects Windows 10 Version 1607 (build 10.0.14393.0). It arises from improper handling of pointers within the VBS Enclave, which could allow an authorized attacker with high privileges to bypass security protections locally. The CVSS 3.1 base score is 5.7, reflecting medium severity with high impact on confidentiality and integrity but no impact on availability. Microsoft has published an official fix for this vulnerability.

An authorized attacker with high privileges on the affected Windows 10 system can exploit this vulnerability to bypass security features implemented by the Virtualization-Based Security Enclave. This could lead to unauthorized access or modification of sensitive information, impacting confidentiality and integrity. There is no known exploitation in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670 to remediate this vulnerability. No additional mitigation actions are indicated by the vendor.