Doyensec runs its own code inside the Windows enclave that holds SmartScreen's password hash
Doyensec ran its own code inside the Windows VBS enclave behind SmartScreen's phishing protection by chaining a four-byte write with a timing bug. Microsoft patched CVE-2026-83498 on September 8, 2026 and says it has not been exploited.
The Watch · Security desk
Three figures. Microsoft rates CVE-2026-83498 Critical, with a CVSS score of 7.8. Doyensec published 35 days after Microsoft's patch. A second call to the enclave's Initialize function writes a fixed four-byte error value to an address the calling program controls.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Microsoft's CVSS score for CVE-2026-83498, rated Critical | 7.8 CVSS | 9 | |
| Patch to publication | 35 days | 19 | |
| Error value a second Initialize call writes | 4 bytes | to an address the calling program controls | 4 |
What happened
- The enclave is SFAPE.dll, the component behind Enhanced Phishing Protection, which warns users who type their Windows sign-in password into an unsafe place.
- The starting point is the Initialize function: a second call writes a fixed four-byte error value to a caller-chosen address and skips the address check the first call performs.
- Aimed at the value that separates enclave memory from host memory, the write disabled a safety check, and a timing bug then let the researchers replace the table of code the enclave may run.
- The fix is cumulative update KB5124008, which covers Windows 11 versions 24H2 and 25H2.
- The update adds a policy that stops the old enclave from loading, and Microsoft lists no separate workaround.
Why it matters
- capability The enclave is built to hold even against SYSTEM or a taken-over kernel. On an unpatched machine, attacker-chosen code ran inside it anyway.
- constraint The chain starts from a program that already loads and calls the enclave, which is LSASS for SFAPE. It is a second step for an intruder already on the box.
- exposure Windows has no general blocklist for vulnerable enclaves, and the older Edge enclave carrying CVE-2023-36880 still loads on a patched machine.
Microsoft rates CVE-2026-83498 Critical, with a CVSS score of 7.8 [9]. For triage the vector matters more. Microsoft lists it as local, with an attacker who needs low-level access and no help from the user [14]. Doyensec's work was a lab proof of concept and has not been seen in real attacks [12]. Microsoft says the flaw was not publicly known before the fix and that it found the same issue internally [9][10].
The research broke the enclave's isolation but did not show that a user's password was read or stolen [8]. Microsoft's advisory describes the impact as data leakage from the enclave or code execution inside it [8].
The first bug is weak on its own. Doyensec wrote that calling the four-byte write an arbitrary write "would be a huge overstatement" [5]. A second flaw, a timing bug in another function, supplied the controlled wipe that made the write useful [6]. Doyensec compared the old and new files and found two changes in the patched enclave: it validates the address ahead of that first write, and it hardens the function the timing bug exploited [17].
Doyensec published on October 13, 35 days after the September 8 patch [11][16][19].
Whether Microsoft left the older Edge enclave loadable on purpose is unclear [21]. Loading a signed but flawed enclave is a known trick [21]. In our view the SFAPE chain is a one-off from a lab, a proof of concept with no reported attacks [12]. We would put more weight on the blocklist gap than on this bug. The September policy blocks only the old SFAPE file [20].
What to watch
- Whether Microsoft blocks the Edge enclave with CVE-2023-36880 or adds a general enclave blocklist like the one it keeps for drivers.
- Any report of CVE-2026-83498 or the Edge enclave flaw used in a real intrusion, since Microsoft currently says the former is unexploited.
- A follow-up from Doyensec showing a sign-in password actually read from the enclave, which this work did not demonstrate.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Doyensec researchers ran their own code inside a VBS enclave, an isolated slice of memory Windows uses to guard secrets.
- [2]
The enclave Doyensec attacked is SFAPE.dll, the component behind Enhanced Phishing Protection in Microsoft Defender SmartScreen, which warns users who enter their Windows sign-in password into an unsafe place such as Notepad or a phishing page.
- [3]
Windows intercepts the sign-in password at login and stores it in hashed form within the enclave; on Windows 11 the program that loads the enclave is lsass.exe, which runs as SYSTEM.
- [4]
Calling the enclave's Initialize function a second time writes a fixed four-byte error value to an address the calling program controls, and skips the address check the first call performs.
- [5]
Doyensec wrote that calling the four-byte write an arbitrary write "would be a huge overstatement."
- [6]
Aimed at the right spot, the write corrupts the value the enclave uses to tell its own memory from the host's, so its safety check stops working; a timing bug in another function then triggers a controlled wipe that redirects how the enclave looks up a stored object, and the resulting read and write let the researchers replace the table that decides which code the enclave may run.
- [7]
The result was attacker-chosen code running inside the enclave.
- [8]
The work broke the enclave's isolation but did not show that a user's password was read or stolen; Microsoft's advisory describes the impact as data leakage from or code execution inside the enclave.
- [9]
CVE-2026-83498 is rated by Microsoft as an elevation-of-privilege issue, Critical, with a CVSS score of 7.8; Microsoft says it has not been exploited and was not publicly known before the fix.
- [10]
Microsoft says it found the same issue internally.
- [11]
Doyensec published its research on October 13, more than a month after the patch.
- [12]
The work was done in a lab as a proof of concept and has not been seen in real attacks.
- [13]
The attack needs a program already running on the machine that loads and calls the enclave; for SFAPE, that program is LSASS.
- [14]
Microsoft's rating lists the attack vector as local, and the attacker needs low-level access and no help from the user.
- [15]
The VBS enclave design is meant to protect what is inside even if an attacker has already taken over the normal kernel or is running as SYSTEM.
- [16]
Microsoft fixed the flaw in the September 8, 2026 cumulative update, KB5124008, for Windows 11 versions 24H2 and 25H2.
- [17]
Doyensec compared the old and new files and found the patched enclave now checks the address before that first write and tightens the function the timing bug relied on.
- [18]
The update also ships a new policy that prevents the old, vulnerable enclave from loading, so a patched system cannot run it; there is no separate workaround, and installing the update is the action.
- [19]
Doyensec published 35 days after Microsoft's patch.
- [20]
Windows has no general blocklist for vulnerable enclaves like the one it keeps for vulnerable drivers, and the September policy only blocks the old SFAPE file; an older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880 from 2023, is still allowed to load.
- [21]
Whether leaving the Edge enclave loadable was a deliberate choice or an oversight is unclear, and loading a signed but flawed enclave is a known trick.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comFour-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Windows SecurityFollow
- Vulnerability researchFollow
- VBS enclavesFollow