Loading story…
Doyensec researcher Adrian Denkiewicz disclosed an exploit chain for CVE-2026-83498 in SFAPE.dll, the Windows virtualization-based security (VBS) enclave supporting Microsoft Defender SmartScreen Enhanced Phishing Protection. A missing pointer-validation check during repeated initialization enabled a fixed four-byte memory write, which researchers expanded into enclave memory reads, writes, and execution of existing code in Isolated User Mode. The chain combined corrupted address validation, a ClipboardInput race, credential-context manipulation, and changes to writable call-target metadata.
Microsoft patched the vulnerability on September 8, 2026, and updated VBS Code Integrity policy to reject older SFAPE.dll images, addressing rollback to vulnerable versions. VBS uses hardware virtualization to isolate sensitive security functions from the normal operating system, making the demonstrated enclave compromise significant. However, the research established control over a test enclave instance—not a confirmed compromise of the Secure Kernel or the production LSASS-hosted enclave. Security teams should verify deployment of the Windows security update and associated policy protections rather than assume that enabling VBS alone mitigates the flaw.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Adrian Denkiewicz published technical details showing how the constrained initialization write could be expanded into enclave memory reads, writes, and existing-code execution in Isolated User Mode. The demonstration controlled a researcher-created SFAPE enclave instance, not the Secure Kernel or the production LSASS-hosted enclave.
Doyensec received advisory credit for the SFAPE vulnerability research.
Researchers received confirmation from MSRC that their reported vulnerability was a duplicate issue.
Microsoft released KB5124008 with SFAPE.dll version 10.0.26100.9444, adding request-range validation and hardening ClipboardInput handling. The updated VBS Code Integrity policy rejects older SFAPE.dll images.
Researchers reported an expanded exploit chain achieving existing-code execution in VTL1. The chain combined corrupted pointer validation, a ClipboardInput race, credential-context manipulation, and changes to writable call-target metadata.
Researchers reported the SFAPE.dll Initialize bug to MSRC. Repeated initialization wrote a fixed four-byte value to a caller-controlled address without validating the destination.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcethehackernews.com
Open sourcereddit.com
Open sourceblog.doyensec.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed two elevation-of-privilege vulnerabilities affecting **Windows Virtualization-Based Security (VBS)**, including **CVE-2025-47159** and **CVE-2025-21370**. The issues impact VBS components designed to harden Windows by isolating sensitive processes and security functions from the rest of the operating system. One of the flaws specifically affects **VBS Enclaves**, while the other targets VBS more broadly, indicating that protected execution environments within Windows can still present privilege-escalation risk if not patched. Microsoft published both entries through its Security Update Guide, signaling that organizations relying on VBS-backed protections should prioritize remediation and review exposure across systems using these security features.
Jul 8, 2025
Microsoft published security advisories for several vulnerabilities affecting **Windows Virtualization-Based Security (VBS)** and **VBS Enclave** components, including elevation-of-privilege issues tracked as `CVE-2025-48803`, `CVE-2025-48811`, and `CVE-2025-53717`. The advisories indicate that flaws in these protected execution and isolation features could allow an attacker to gain higher privileges on affected Windows systems. Microsoft also disclosed `CVE-2025-21340`, a **security feature bypass** in Windows VBS, expanding the scope beyond privilege escalation to weaknesses that could undermine VBS protections themselves. Together, the advisories highlight repeated security issues in Windows virtualization-based isolation mechanisms and reinforce the need for organizations using VBS-backed protections to review affected systems and apply Microsoft updates.
Oct 14, 2025
Check Point Research detailed how the **EternalBlue** exploit achieves remote code execution against vulnerable Windows machines by abusing `CVE-2017-0144` in Microsoft bulletin `MS17-010` over `SMBv1`. The exploit, leaked by **The Shadow Brokers** in the "Lost in Translation" dump, targets Windows versions prior to Windows 8 and chains multiple flaws in `srv.sys` to gain kernel-level code execution. The research identified three key bugs: a wrong-casting flaw in FEA conversion that causes a non-paged pool overflow, a transaction parsing flaw that creates the size confusion needed to trigger it, and a session setup flaw that enables controlled heap grooming. The paper showed how attackers can shape kernel memory, overwrite `srvnet` structures and an `MDL`, redirect writes into the executable HAL heap on older systems, and execute payloads such as **DoublePulsar** when a crafted `srvnet` connection closes, with packet-level attack flow illustrated in a successful Windows 7 exploitation trace.
Sep 29, 2017