Security researchers have successfully executed their own code within a secure segment of Windows, intended to remain inaccessible even when other parts of the system are compromised. This segment, known as a Virtualization-based Security (VBS) enclave, is a protected memory area used by Windows to safeguard sensitive information such as passwords for anti-phishing features.
Details of the Windows Vulnerability
The research was conducted in a controlled environment to demonstrate the vulnerability, which has not been observed in actual cyber attacks. Microsoft addressed the issue in its September 8, 2026 update. The flaw, identified as CVE-2026-83498, is classified by Microsoft as a critical elevation-of-privilege vulnerability with a CVSS score of 7.8. The security firm Doyensec published their findings on October 13, following the patch release.
A VBS enclave operates as a signed library loaded by Windows programs, where its memory is kept isolated by the Windows hypervisor. This design ensures that even if the main system is compromised, the enclave remains secure. Doyensec’s ability to run unauthorized code within this secure environment underscores the significance of their findings.
Understanding the Exploit Methodology
The compromised component, SFAPE.dll, functions as part of the Enhanced Phishing Protection feature in Microsoft Defender SmartScreen. This feature monitors text input and alerts users if their Windows login credentials are entered into potentially unsafe locations. The enclave stores such passwords in a hashed format, enabling secure verification against future inputs.
The attack necessitates local access, requiring an already running program to interact with the enclave. The attack vector is therefore limited to local systems where low-level access has been gained, emphasizing that this method is not a remote exploitation technique.
Mitigation and Remaining Challenges
Microsoft’s September update, identifiable as KB5124008, addressed the vulnerability by implementing stricter checks within the enclave’s code. The update also introduced a policy preventing the loading of the previously vulnerable enclave, thereby ensuring patched systems are protected. While no additional workarounds are needed, one issue persists. Windows lacks a comprehensive blocklist for vulnerable enclaves, similar to the one used for drivers. Consequently, older enclaves with similar vulnerabilities may still be exploited.
Doyensec highlights that an older enclave used by Microsoft Edge, sharing a similar flaw identified as CVE-2023-36880, remains active, raising questions about Microsoft’s decisions regarding enclave management. This situation reveals ongoing risks associated with old, signed but vulnerable enclaves, which could potentially be exploited by malicious actors.
As the cybersecurity landscape evolves, continuous vigilance and timely updates remain crucial for maintaining system integrity and protecting sensitive information from exploitation.
