CVE-2026-20935

MediumCVSS 6.2/10Last modified Jul 30, 2026

Description

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-822

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-209364.3Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.CVE-2026-209375.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information loCVE-2026-209387.8Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locCVE-2026-209395.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information loCVE-2026-20948.8Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands tCVE-2026-209407.8Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-209417.8Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate prCVE-2026-209437.0Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-209448.4Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-209455.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-209467.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-209478.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized att
CVE-2026-20935: Medium severity, CVSS 6.2 | Vulnix