Windows SmartScreen enclave flaw let researchers run code inside its walls

A newly disclosed Windows vulnerability let researchers run attacker-chosen code inside a protected VBS enclave used by Microsoft Defender SmartScreen. The flaw needed an existing foothold on the machine, and Microsoft patched it on 8 September 2026.¹²

Why the enclave mattered

VBS enclaves are isolated regions of memory designed to protect sensitive workloads from both their host process and the rest of Windows. Microsoft describes the technology as a trusted execution environment managed with help from the Windows hypervisor.³

The researchers targeted SFAPE.dll, the enclave component behind Enhanced Phishing Protection. That feature watches for passwords typed or pasted into unsafe locations, while the password material used for checking is handled inside the enclave rather than exposed to ordinary code.¹²

How the attack worked

Doyensec chained two bugs. Calling the enclave's Initialize function a second time caused it to write a fixed four-byte value to a caller-controlled address without repeating the address check from the first call. The researchers used that corruption to interfere with the enclave's memory-boundary checks.²

A separate timing issue then helped turn the small write into a controlled memory operation. That operation let the researchers replace the table governing which code the enclave could execute, ultimately producing code execution inside the isolated environment.¹²

This was a laboratory proof of concept, not evidence that attackers had stolen Windows passwords. The attack was local: an attacker already needed code running on the computer, plus the low-level access required to load and call the vulnerable enclave.¹

The fix and the remaining concern

Microsoft fixed CVE-2026-83498 in the 8 September cumulative update for Windows 11 24H2 and 25H2. The patched SFAPE component validates the target range before the repeated-initialisation write, tightens the affected input path and blocks older vulnerable SFAPE files from loading.¹²⁴

Doyensec said the broader VBS enclave model still lacks a general blocklist comparable to Windows' vulnerable-driver blocklist. It also pointed to an older Edge enclave with a similar issue that remains loadable, leaving a wider policy question after this specific flaw has been closed.²

Our opinion

This is a useful reminder that a security boundary can fail without the operating system being remotely exploitable. The practical action is straightforward: install Microsoft's September update, but defenders should also treat signed enclave components as code that needs lifecycle controls, not as automatically safe because the hypervisor is involved.¹²⁴