Microsoft Windows SmartScreen VBS Enclave Flaw Allowed Code Execution in Lab

Security researchers at Doyensec demonstrated a lab proof-of-concept attack that executed custom code inside a Windows 11 Virtualization-Based Security (VBS) enclave, breaking isolation designed to protect secrets in VTL1 memory even if the standard kernel or SYSTEM is compromised. Tracked as CVE-2026-83498 with a 7.8 CVSS score and a Critical elevation-of-privilege rating, the local vulnerability targeted SFAPE.dll, the Microsoft $MSFT Defender SmartScreen enclave loaded by lsass.exe to store hashed sign-in passwords for Enhanced Phishing Protection. The attack chained a second call to the enclave's Initialize function, which skipped an address check and wrote a four-byte error value to corrupt memory boundary checks, with a timing bug that let researchers overwrite the enclave's code execution table. Microsoft also discovered the flaw internally, confirmed it has not been exploited in real attacks, and patched it in the September 8, 2026 cumulative update (KB5124008) for Windows 11 versions 24H2 and 25H2 alongside a policy blocking the old SFAPE file. Doyensec noted on October 13 that Windows still lacks a general blocklist for vulnerable enclaves similar to its vulnerable driver blocklist, leaving an older flawed Microsoft Edge enclave from 2023 (CVE-2023-36880) loadable on patched systems.