Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave

Researchers from Doyensec demonstrated a proof-of-concept exploit against a Windows VBS enclave (SFAPE.dll) used by Microsoft Defender SmartScreen's Enhanced Phishing Protection, achieving code execution within the isolated environment. The attack leveraged a four-byte write vulnerability and a timing bug to bypass memory isolation, ultimately allowing an attacker with local SYSTEM access to load and execute arbitrary code inside the enclave. The vulnerability, tracked as CVE-2026-83498, was patched by Microsoft in the September 8, 2026 update (KB5124008). Although not exploited in the wild, the research highlights risks from loadable vulnerable enclaves, as older flawed enclaves like one affected by CVE-2023-36880 remain allowed to load despite known exploits.

AI-extracted · verify before operational use