Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over.
The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature.
The work was done in a lab as a proof of concept, has not been seen in real attacks, and Microsoft fixed the flaw in its September 8, 2026 update.
The flaw is tracked as CVE-2026-83498. Microsoft rates it an elevation-of-privilege issue, Critical, with a CVSS score of 7.8, and says it has not been exploited and was not publicly known before the fix. Microsoft also says it found the same issue internally. The research, by the security firm Doyensec, was published October 13, more than a month after the patch.
A VBS enclave is a signed library that a normal Windows program loads but cannot read or change once it is running. The Windows hypervisor keeps the enclave’s memory in a more trusted world, called VTL1 or Isolated User Mode, that ordinary code in the normal world, VTL0, cannot reach, according to Microsoft.
The design is meant to protect what is inside even if an attacker has already taken over the normal kernel or is running as SYSTEM. Running attacker-chosen code inside that world is what makes this research notable.
The enclave Doyensec attacked is SFAPE.dll, the component behind Enhanced Phishing Protection in Microsoft Defender SmartScreen. That feature watches text you type or paste and warns you if you enter your Windows sign-in password into an unsafe place, such as Notepad or a phishing page.
To do this without exposing the password, Windows intercepts it at login and stores it in hashed form within the enclave, so later inputs can be checked against it. On a Windows 11 system, the program that loads this enclave is lsass.exe, the process that handles sign-in credentials and runs as SYSTEM.
The attack does not work from a distance. It needs a program already running on the machine that loads and calls the enclave; for SFAPE, that’s LSASS. Microsoft’s own rating says the same: the attack vector is local, and the attacker needs low-level access and no help from the user. In short, this is a way for code that already has a foothold to reach into the more trusted world next to it, not a way in from outside.
Doyensec built the attack from a small mistake and widened it step by step. Calling the enclave’s Initialize function a second time makes it write a fixed four-byte error value to an address the calling program controls, and this time it skips the address check the first call performs.
Doyensec is clear that this alone is weak, writing that calling it an arbitrary write “would be a huge overstatement.” Aimed at the right spot, though, that one write corrupts the value the enclave uses to tell its own memory from the host’s, so its safety check stops working. From there, a timing bug in another function triggers a controlled wipe. That wipe redirects how the enclave looks up a stored object, and the resulting read and write let the researchers replace the table that decides which code the enclave may run.
The result is attacker-chosen code running inside the enclave. The work broke the enclave’s isolation; it did not show that a user’s password was read or stolen, and Microsoft’s advisory describes the impact as data leakage from or code execution inside the enclave.
Microsoft fixed the flaw in the September 8, 2026 cumulative update, KB5124008, for Windows 11 versions 24H2 and 25H2. Doyensec compared the old and new files and found the patched enclave now checks the address before that first write and tightens the function the timing bug relied on.
The update also ships a new policy that prevents the old, vulnerable enclave from loading at all, so a patched system cannot run it. There is no separate workaround to apply; installing the update is the action.
One gap outlives this fix. Windows has no general blocklist for vulnerable enclaves like the one it keeps for vulnerable drivers, and the September policy only blocks the old SFAPE file. An older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880 from 2023, is still allowed to load, Doyensec said.
Whether that was a deliberate choice or an oversight is unclear. That matters because loading a signed but flawed enclave is a known trick, sometimes called “bring your own vulnerable enclave,” that earlier research from Akamai and Outflank used to hide code and data from security tools. Blocking one flawed enclave while leaving another loadable leaves that trick available.
