Four-Byte Write and Timing Bug Let Researchers Run Code in Windows Smart Screen Enclave

Summary: Researchers at Doyensec ran their own code inside a Windows VBS enclave, the isolated memory region that guards secrets even when the normal kernel is compromised, targeting SFAPE.dll, the component behind Enhanced Phishing Protection in Microsoft Defender SmartScreen. The attack chains a four-byte write from calling the enclave's Initialize function a second time with a timing bug to replace the table deciding which code the enclave may run; Microsoft rated it Critical with a CVSS score of 7.8, tracked it as CVE-2026-83498, and fixed it in the September 8, 2026 update KB5124008 for Windows 11 24H2 and 25H2.
Bottom line: The enclave is designed to hold even when an attacker already has the kernel or SYSTEM, and this work broke that isolation from a local foothold with no user interaction. Windows still has no general blocklist for vulnerable enclaves the way it does for drivers, and Doyensec notes the older Edge enclave CVE-2023-36880 is still allowed to load, leaving the 'bring your own vulnerable enclave' trick available.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-83498
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026