Doyensec reported that a lab-built attack chain achieved code execution inside SFAPE, the virtualized security enclave used by Microsoft Defender SmartScreen’s Enhanced Phishing Protection. The chain required code already running locally that could load and call the enclave; Doyensec identified Microsoft’s September 8, 2026, update KB5124008 as the fix for Windows 11 24H2 and 25H2.
What the SmartScreen research demonstrated
Enhanced Phishing Protection can warn when a password is stored in an unsafe way. The vulnerability Doyensec reported, CVE-2026-83498, affected SFAPE.dll, the Virtualization-Based Security (VBS) enclave used by that SmartScreen feature. Doyensec researcher Adrian Denkiewicz published the technical account on October 13, 2026, describing code execution inside the enclave in a lab. The demonstrated impact was execution within SFAPE—not password theft. (Doyensec’s technical research; Microsoft’s SmartScreen overview)
The described chain was not a remote entry route: an attacker first needed code running on the computer and a process able to load and call the enclave. Doyensec says SFAPM.dll, loaded by lsass.exe, creates and calls SFAPE. Windows Local Security Authority (LSA) protection can restrict processes from reading or injecting code into LSASS unless they meet its protection requirements; configuration and installation history can affect whether that protection is enabled. (Doyensec)
How the four-byte write became code execution
The chain began when the enclave’s Initialize function was called again after setup. That repeated call triggered a fixed four-byte status write through a request pointer controlled by the caller. By itself, the write was not an unrestricted arbitrary-write capability.
Doyensec’s account describes how the researchers combined the write with a range-check bypass and a timing-dependent race involving ClipboardInput. Together, those flaws enabled constrained memory reads and writes and ultimately changed the enclave’s valid-target table, allowing code execution inside SFAPE. The result depended on chaining several weaknesses, not on the four-byte write alone. (Doyensec’s technical analysis)
The tested build and Microsoft’s update
Doyensec tested on Windows 11 25H2 build 26200.8973. Its report identifies the tested components as SFAPE.dll 10.0.26100.8875 and vertdll.dll 10.0.26100.8972; it compared SFAPE with patched version 10.0.26100.9444. These DLL versions identify components, not Windows operating-system builds. (Doyensec)
Doyensec identifies Microsoft’s KB5124008, dated September 8, 2026, as the fix. Microsoft’s notice applies to all editions of Windows 11 24H2 and 25H2 and lists OS builds 26100.9445 and 26200.9445. (Microsoft’s KB5124008 notice; Doyensec’s technical research)
Doyensec says the update validates the request before the repeated-initialization write, tightens ClipboardInput handling to prevent the demonstrated race, and uses a code-integrity policy that rejects older SFAPE images. That account links the specific patch changes to the weaknesses used in the lab chain.
The disclosure timeline also places the public write-up after the update: Doyensec says it reported the initial write issue to Microsoft’s Security Response Center on August 7, 2026, and reported the expanded code-execution result on August 11. Microsoft released KB5124008 on September 8; Doyensec published its technical account on October 13. (Doyensec; Microsoft’s KB5124008 notice)
A separate finding involving an older Edge enclave
Doyensec’s October 13 report also said an older Microsoft Edge enclave associated with CVE-2023-36880 remained loadable under the policy state the researchers examined. That observation concerns a separate enclave and vulnerability from CVE-2026-83498. (Doyensec; Google Security Research’s CVE-2023-36880 advisory)
