Windows SmartScreen Enclave Flaw Let Researchers Run Code in Its Protected Environment
Summary
Researchers demonstrated local code execution inside Windows’ SmartScreen enclave via CVE-2026-83498. Microsoft patched the flaw in its September 8, 2026 update; the proof of concept was not seen in real attacks.
Key points
- Doyensec demonstrated a way to run attacker-chosen code inside SFAPE.dll, the VBS enclave used by Microsoft Defender SmartScreen’s Enhanced Phishing Protection.
- The local attack requires code already running on the system that can load and call the enclave; it is not a remote entry path.
- A repeated Initialize call performs an unchecked four-byte write, which can corrupt the enclave’s memory-boundary value; a timing bug then enables controlled memory operations and replacement of the allowed-code table.
- The research demonstrated breaking enclave isolation, but did not show that passwords were read or stolen.
- Microsoft rates CVE-2026-83498 Critical with a CVSS score of 7.8 and says it was neither exploited nor publicly known before the fix.
- Microsoft patched the flaw in the September 8, 2026 cumulative update KB5124008 for Windows 11 versions 24H2 and 25H2; the update also blocks the vulnerable enclave from loading.
- Doyensec says a separate, older Microsoft Edge enclave with a similar flaw, CVE-2023-36880, remains loadable, leaving a related vulnerable-enclave technique possible.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Timing bug
- Severity
- Critical (CVSS 7.8)
- Affected Versions
- Windows 11 24H2
- Windows 11 25H2
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2023-36880only blocks the old SFAPE file. An older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880 from 2023, is still allowed to load, Doyensec said.CVE-2026-83498The flaw is tracked as CVE-2026-83498. Microsoft rates it an elevation-of-privilege issue, Critical, with a CVSS score of 7.8, and says it has not been exploited and was not publicly known before the fix. Microsoft also
Vendors
Products
Microsoft Defender SmartScreenenclave Doyensec attacked is SFAPE.dll, the component behind Enhanced Phishing Protection in Microsoft Defender SmartScreen. That feature watches text you type or paste and warns you if you enter your Windows sign-inMicrosoft Edgeit keeps for vulnerable drivers, and the September policy only blocks the old SFAPE file. An older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880 from 2023, is still allowed to load,Microsoft WindowsSecurity researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over.