Cybersecurity
Researchers run code in Windows SmartScreen enclave
Doyensec described a local exploit chain that let it execute code inside the SFAPE.dll enclave used by Microsoft Defender SmartScreen, and Microsoft had already patched the flaw in September.
- Doyensec said it had demonstrated the issue only in a lab, and it had not seen the technique used in attacks.
- Microsoft fixed CVE-2026-83498 in the September 8, 2026 cumulative update KB5124008 for Windows 11 versions 24H2 and 25H2.
- Microsoft rated the flaw as an elevation-of-privilege issue with a CVSS score of 7.8, and said it had not been publicly known before the patch.
- The enclave under attack was SFAPE.dll, which supports Enhanced Phishing Protection in Microsoft Defender SmartScreen and is loaded by lsass.exe.
- Doyensec said Windows still allowed an older Microsoft Edge enclave with a similar flaw to load.
Doyensec published its work on 13 October, after Microsoft had already shipped the fix. The researchers said they had managed to execute their own code inside the enclave used by SmartScreen password checking.
The target was SFAPE.dll, a signed library that Windows loaded through lsass.exe to support Enhanced Phishing Protection in Microsoft Defender SmartScreen. Microsoft said the enclave kept data in a more trusted memory area that normal code could not reach.
Doyensec said the chain began when a second call to Initialize caused a four-byte write at an address chosen by the host process. It said that write, together with a timing bug, let it disturb internal state, bypass a safety check and redirect object handling until it could change the table governing allowed code.
The researchers said that resulted in code execution inside the enclave, but not in password theft. Microsoft’s advisory described the impact as data leakage from, or code execution inside, the enclave, and said the attack needed local access and no user help.
Microsoft’s update also prevented the vulnerable SFAPE build from loading on patched systems, and Doyensec said no separate workaround existed beyond installing it. Doyensec also said Windows lacked a general blocklist for vulnerable enclaves, and that an older Microsoft Edge enclave with CVE-2023-36880 could still load.
Named in this story
Companies
- Doyensec
- published the proof-of-concept research
- Microsoft
- fixed the flaw and assessed its severity
Products and systems
- Windows 11
- ran the affected enclave on versions 24H2 and 25H2
- Microsoft Defender SmartScreen
- used the enclave for Enhanced Phishing Protection
- SFAPE.dll
- was the enclave Doyensec attacked
- lsass.exe
- loaded the enclave and handled sign-in credentials
- KB5124008
- was the September cumulative update that fixed the flaw
- Microsoft Edge
- had an older enclave that Doyensec said was still loadable
How the source tells it
The piece was mostly plain technical reporting, with no distinct emotive framing beyond a slight emphasis on the exploit chain and the remaining exposure.
No emotive framing was found in the original.