Researchers Execute Code Inside Windows SmartScreen VBS Enclave
A four-byte memory corruption flaw bypassed Virtualization-Based Security isolation protections.
1Breaking Virtualization Isolation
Security firm Doyensec demonstrated arbitrary code execution inside a Windows Virtualization-Based Security enclave. Tracked as CVE-2026-83498 with a 7.8 CVSS score, the flaw breached the isolated memory boundary designed to shield sensitive operations even from a compromised kernel or SYSTEM process.
2Targeting Credential Protection
The exploit targeted SFAPE.dll, the component powering Enhanced Phishing Protection in Microsoft Defender SmartScreen. Loaded by lsass.exe, this library stores hashed login passwords within Isolated User Mode to detect credential theft while preventing host memory inspection from standard operating system processes.
3Local Attack Vector Scope
This elevation-of-privilege vulnerability requires existing local access on the target machine and cannot be triggered remotely. An attacker must control a process that communicates directly with the enclave interface, utilizing this vector to escalate privileges across trust boundaries rather than establishing initial access.
4Initial Four-Byte Memory Corruption
The attack sequence starts by invoking the enclave's initialization function a second time. This call bypasses initial boundary validation and writes a four-byte error value to a user-controlled address, corrupting internal tracking variables used to separate enclave memory from the host operating system.
5Exploiting Race Condition Primitives
Researchers chained that memory corruption with a timing bug in a secondary function to cause a controlled wipe. This manipulation altered object lookup tables, granting read and write primitives that allowed replacing internal dispatch pointers to execute arbitrary attacker-chosen code within VTL1.
6Patching Logic and Invalidation
Microsoft addressed the vulnerability in update KB5124008 for Windows 11 versions 24H2 and 25H2. The patch enforces strict address validation on re-initialization calls, resolves the concurrency flaw, and deploys a system policy preventing older, vulnerable SFAPE.dll binaries from loading.
7Absence of Unified Denylist
While Microsoft blocked the vulnerable SmartScreen file, Windows lacks a comprehensive revocation list for signed enclaves. Older flawed components, such as a 2023 Microsoft Edge enclave associated with CVE-2023-36880, still remain loadable on patched systems without global administrative enforcement.
8Bring Your Own Enclave Risks
The persistence of outdated, signed binaries preserves the bring-your-own-vulnerable-enclave technique discovered by previous researchers. Adversaries can load known vulnerable libraries to execute hidden payloads within Isolated User Mode, bypassing endpoint detection systems unless operating systems enforce broad, dynamic enclave revocation policies.
Original article: The Hacker News — Researchers Execute Code Inside Windows SmartScreen VBS Enclave