Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft Windows and Windows Server - CVE-2026-70075

Vulnerability details

The vulnerability allows a local privileged user to bypass the Windows Key Storage Provider security feature.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Virtualization-Based Security (VBS) Enclave when performing security checks. A local privileged user can exploit the race condition locally to bypass the Windows Key Storage Provider security feature.

The Windows Key Storage Provider issues key certificates for trust in attestation scenarios.

Affected software

How to mitigate CVE-2026-70075

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70075

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows