CVE-2026-83498
CVSS 7.8 HIGH: untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to… EPSS 0.3% (25th percentile). Microsoft patch: 5122871.
Patch available KB5122871 Download →
Vulnerabilities · 11h ago
Doyensec published proof-of-concept research on October 13 showing that CVE-2026-83498 in Microsoft Windows 11 SmartScreen let local code run inside the SmartScreen VBS enclave, after Microsoft patched the flaw on September 8. Microsoft says it had already found the issue internally and has not seen active exploitation.
The bug sits in SFAPE.dll, the SmartScreen component that helps protect sign-in passwords. A Windows process loads the signed enclave, then a four-byte write and timing mistake let the caller write into memory that should have stayed sealed off, so code already on the machine could cross into the protected trust boundary instead of being stopped by it.
For teams that rely on VBS enclaves to protect secrets on compromised endpoints, the important lesson is that enclave isolation depends on the enclave implementation as much as on the host. The reporting does not show in-the-wild abuse, but it does show that a local foothold can become code inside a supposedly unreadable boundary.
CVSS 7.8 HIGH: untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to… EPSS 0.3% (25th percentile). Microsoft patch: 5122871.
Patch available KB5122871 Download →
1 source covering this story
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
A Windows 11 SmartScreen flaw allowed researchers with local access to run code inside a VBS enclave; Microsoft patched it in September.
Part of the PlainSec briefing for 2026-10-14