Full Report
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of
Analysis Summary
# Vulnerability: Windows VBS Enclave Arbitrary Code Execution via SFAPE.dll
## CVE Details
- **CVE ID**: CVE-2026-83498
- **CVSS Score**: 7.8 (Critical / High)
- **CWE**: Not explicitly stated, involves Improper Check for Unusual or Exceptional Conditions and Timing Side-Channel.
## Affected Systems
- **Products**: Microsoft Windows 11
- **Versions**: Versions 24H2 and 25H2
- **Configurations**: Systems utilizing Virtualization-Based Security (VBS) enclaves, specifically the **SFAPE.dll** component used for Enhanced Phishing Protection in Microsoft Defender SmartScreen.
## Vulnerability Description
The vulnerability allows an attacker to bypass the isolation of a Virtualization-Based Security (VBS) enclave. The flaw resides in `SFAPE.dll`, which runs in Isolated User Mode (VTL1).
1. **Four-Byte Write**: By calling the enclave's `Initialize` function a second time, a fixed four-byte error value is written to a caller-controlled address because the enclave fails to perform a bounds check on the second call.
2. **Memory Corruption**: This write is used to corrupt the enclave's internal memory boundary definitions.
3. **Timing Bug**: A timing side-channel in another enclave function is leveraged to trigger a controlled memory wipe and redirect object lookups.
Combined, these flaws allow an attacker to replace the enclave's function table, leading to arbitrary code execution within the trusted VTL1 environment.
## Exploitation
- **Status**: Proof of Concept (PoC) developed by researchers (Doyensec); not observed in the wild.
- **Complexity**: High (Requires multiple steps and chaining primitive writes with timing bugs).
- **Attack Vector**: Local (Requires the attacker to already have a foothold on the machine, typically with SYSTEM privileges to interact with `lsass.exe`).
## Impact
- **Confidentiality**: High (Potential leakage of data from within the secure enclave).
- **Integrity**: High (Ability to run attacker-chosen code in a protected execution environment).
- **Availability**: High (Potential to crash or disrupt the security features relying on the enclave).
## Remediation
### Patches
- **Microsoft September 8, 2026 Update**: Install cumulative update **KB5124008** for Windows 11 24H2 and 25H2. This patch introduces address validation for the initial write and addresses the timing side-channel.
### Workarounds
- **Vulnerable Enclave Block**: The September update includes a new policy that prevents the loading of the specific vulnerable version of `SFAPE.dll`. Users should ensure the latest security updates are applied as there are no manual configuration workarounds.
## Detection
- **Indicators of Compromise**: Unexpected crashes or restarts of the Local Security Authority Subsystem Service (`lsass.exe`).
- **Detection Methods**: Monitor for unauthorized attempts to call enclave functions outside of standard system processes. Security teams should verify the presence of the September 2026 patch level to ensure the blocklist policy is active.
## References
- **Vendor Advisory**: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83498](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83498)
- **Researcher Technical Write-up**: [https://blog.doyensec.com/2026/10/13/Sfape.html](https://blog.doyensec.com/2026/10/13/Sfape.html)
- **Microsoft Support KB**: [https://support.microsoft.com/en-gb/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update](https://support.microsoft.com/en-gb/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update)