CVE-2025-21370

CVE-2025-21370 is a Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability. It affects the VBS Enclave component in Windows systems that utilize virtualization-based security features. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-20 (Improper Input Validation), as indicated by NVD-CWE-noinfo. It was published on 2025-01-14.

A local attacker with low privileges can exploit this vulnerability through low-complexity techniques requiring no user interaction. Successful exploitation enables elevation of privileges, resulting in high impacts to confidentiality, integrity, and availability within the affected scope.

Microsoft's Security Response Center provides an update guide for mitigation details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21370.