Four-Byte Write and Timing Bug Let Code Run in Windows Enclave
SFAPE.dll sits behind Enhanced Phishing Protection in Microsoft Defender SmartScreen. On October 13, 2026, Doyensec researcher Adrian Denkiewicz published a technical analysis of a flaw in the component.
The lab-only demonstration ran attacker-chosen code inside a Windows VBS enclave, which is designed to stay isolated even if the rest of the computer is compromised. It did not show that anyone's password was read or stolen.
Microsoft fixed CVE-2026-83498 in its September 8, 2026 cumulative update, more than a month before Doyensec published its findings. The company rates it a Critical elevation-of-privilege issue, with a CVSS score of 7.8. Microsoft says the flaw was neither exploited nor publicly known before the patch. The company found it internally, and treated Doyensec's report as a duplicate.
How the enclave boundary failed
Windows uses Enhanced Phishing Protection to detect when someone types or pastes a Windows sign-in password into an unsafe location, such as Notepad or a phishing page. The password is intercepted at login and stored in hashed form inside the enclave, where later input can be checked without exposing it. A regular process loads and initializes the enclave. It then calls it through Windows' CreateEnclave and CallEnclave interfaces.
The first flaw let a second call to the enclave's Initialize function trigger a four-byte write. The function wrote a fixed error value to an address controlled by the calling program, bypassing the address check performed during initialization. On its own, Doyensec said, the flaw did not provide a meaningful arbitrary write. The researchers used it to corrupt a value that distinguishes enclave memory from host memory. That disabled a safety check.
A timing bug then enabled a controlled wipe. This redirected the enclave's lookup of a stored object and gave the researchers read and write operations. They used those operations to replace the table that controls which code the enclave can run. Doyensec described turning the initial memory-write primitive into a chain of capabilities that gave them control over the enclave instance.
The result was code execution across the enclave boundary.
On Windows 11, lsass.exe loads and calls the enclave. The attack is local: a program must already be running on the computer and call the enclave. Microsoft says the attacker needs low-level access. No user interaction is required.
The patch blocks the vulnerable enclave
VBS enclaves are signed libraries whose memory the Windows hypervisor protects in VTL1, or Isolated User Mode. Regular applications and the calling process run in VTL0 and cannot access that memory. The design aims to protect enclave contents even if an attacker compromises the normal operating system. SFAPE.dll receives data from the less-trusted host process, so its code must validate incoming pointers. It also has to check addresses and buffer sizes rather than trust memory references supplied by the host.
Doyensec published its research on October 13, more than a month after the patch. A separate Defender file-reading report described a different proof of concept involving protected-file access, not code execution inside this enclave.
Microsoft's KB5124008 update covers Windows 11 versions 24H2 and 25H2. The vulnerable SFAPE.dll was version 10.0.26100.8875; the patched file is version 10.0.26100.9444. Doyensec's technical analysis says the patched enclave checks the address before writing and tightens the function involved in the timing flaw. The update also includes a revised VbsSiPolicy.p7b policy that blocks older SFAPE.dll images from loading. Microsoft offers no separate workaround and recommends installing the update.
A wider blocklist gap remains
Windows has no general blocklist for vulnerable enclaves comparable to its blocklist for vulnerable drivers. The September policy blocks the old SFAPE file. But Doyensec noted that an older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880, is still allowed to load. The researchers said it was unclear whether that was deliberate or an oversight.
Loading a signed but vulnerable enclave to hide code and data from security tools is sometimes called "bring your own vulnerable enclave." Earlier research from Akamai and Outflank used the technique. The SFAPE block addresses that specific file, while the older Edge enclave remains loadable.
