Security October 2026 CVE-2026-88074
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Severity Critical
CVSS base score 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact Elevation of Privilege
EPSS, next 30 days 0.3% Higher than 25.3% of scored CVEs · FIRST model run 25 Oct 2026 · about EPSS
Public exploit code No Nuclei template lists it
Exploitability Exploitation Less Likely
Publicly disclosed No
Customer action Required: apply the update
Component Windows Virtualization-Based Security (VBS) Enclave
Weakness CWE-190: Integer Overflow or Wraparound
Issued by Microsoft
Last revised 13 Oct 2026 CVSS 3.1 base metrics Red raises the risk · green lowers it
Attack vector LocalAV:L
Attack complexity LowAC:L
Privileges required LowPR:L
User interaction NoneUI:N
Scope UnchangedS:U
Confidentiality HighC:H
Integrity HighI:H
Availability HighA:H
3 KBs KB Type Restart Applies to Other CVEs KB5126653 Security Update Required Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems All CVEs in KB5126653 KB5127646 Security Update Required Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems All CVEs in KB5127646 KB5127648 Security Update Required Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more All CVEs in KB5127648
Source. This summary comes from MSRC's public CVRF document for October 2026. If the MSRC page is blocked in your browser, the NVD and CVE.org records carry the same identifier. None of this says whether your devices are affected.
Explore global source statements, affected packages and advisory history for CVE-2026-88074 . The catalog has a separate collection scope from Microsoft release records.
Overview Affected History Connections
cve-program · CVE-2026-88074 Published Windows 11 version 23H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 version 23H2",
"platforms": [
"ARM64-based Systems"
],
"versions": [
{
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 23H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 23H2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7652",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 24H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 24H2",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.9711",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 25H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 25H2",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26200.0",
"lessThan": "10.0.26200.9711",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 version 26H1 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 version 26H1",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.28000.0",
"lessThan": "10.0.28000.3231",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 26H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 26H2",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26300.0",
"lessThan": "10.0.26300.9711",
"versionType": "custom",
"status": "affected"
}
]
}