Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave

Researchers at Doyensec managed to execute their own code inside a Windows VBS enclave, a memory region normally shielded even from an attacker who already controls the kernel or has SYSTEM privileges. Their target was SFAPE.dll, the enclave behind Microsoft Defender SmartScreen's Enhanced Phishing Protection feature, which stores a hashed copy of the user's login password to detect when it's typed into an unsafe app like Notepad or a phishing site. By calling the enclave's Initialize function twice, they triggered an unchecked four-byte write that corrupted an internal memory marker, then combined it with a timing flaw in another function to hijack the enclave's object lookup and swap out its list of permitted code — achieving arbitrary code execution inside the isolated world. The issue, tracked as CVE-2026-83498 with a CVSS score of 7.8, requires local access and was not seen exploited in the wild; it was patched by Microsoft on September 8, 2026 via update KB5124008 for Windows 11 24H2 and 25H2, which also blocks the vulnerable enclave from loading at all. Notably, a similarly flawed Microsoft Edge enclave from 2023 (CVE-2023-36880) remains loadable, and since Windows lacks a blocklist for vulnerable enclaves comparable to its driver blocklist, attackers could still abuse such older signed-but-flawed enclaves to hide malicious activity.