Loading vulnerability…
CVE-2026-83498 is an untrusted pointer dereference vulnerability in the Windows Virtualization-Based Security SFAPE enclave supporting Microsoft Defender SmartScreen Enhanced Phishing Protection. Repeated calls to its exported Initialize function write the fixed four-byte STATUS_ALREADY_INITIALIZED value through a host-controlled pointer without validating the destination against enclave-private memory. This constrained write can corrupt cached enclave-boundary information and undermine subsequent address validation. Researchers chained it with a time-of-check/time-of-use flaw in ClipboardInput to obtain enclave memory read/write capabilities and modify writable call-target metadata, enabling execution of existing code inside the enclave in Virtual Trust Level 1 (VTL1). Microsoft classifies the vulnerability as Critical elevation of privilege with a CVSS v3.1 score of 7.8. The demonstrated attack controlled a researcher-hosted enclave instance; it did not establish compromise of the production LSASS-hosted enclave or the Secure Kernel.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local privilege-escalation vulnerability in Windows' SFAPE.dll VBS enclave, classified by Microsoft as critical with a CVSS score of 7.8. A repeated Initialize call permits a fixed four-byte write to a caller-controlled address, undermining enclave memory validation. Researchers chained this with a timing flaw to obtain read/write capabilities and execute chosen code inside the isolated environment. The laboratory demonstration breached enclave isolation but did not demonstrate password theft. Exploitation requires existing local access and does not require user interaction. Windows 11 update KB5124008 fixes the flaws and blocks loading the old vulnerable SFAPE enclave.
A local elevation-of-privilege vulnerability in SFAPE.dll, the VBS enclave supporting Microsoft Defender SmartScreen Enhanced Phishing Protection. Researchers chained an unchecked four-byte write with memory-validation corruption and a timing bug to execute attacker-chosen code inside the enclave, breaking its isolation. Exploitation requires an existing local foothold and access to the process loading the enclave; it is not a remote entry point. The laboratory demonstration did not establish password theft. Microsoft patched the flaw on September 8, 2026, through KB5124008 and blocked the vulnerable SFAPE enclave from loading.
A reported security issue involving memory-corruption vulnerabilities in the Windows SFAPE.dll VBS enclave. Researchers chained the vulnerabilities to achieve code execution inside the enclave at VTL1, undermining its isolation guarantees. Microsoft addressed the issue in September 2026.
A memory-corruption vulnerability in SFAPE.dll, the Windows VBS enclave supporting Microsoft Defender SmartScreen Enhanced Phishing Protection. A malicious enclave host can obtain a fixed-value four-byte write through repeated initialization. The demonstrated chain corrupts enclave-range validation, exploits a ClipboardInput descriptor race, establishes constrained read/write primitives, and modifies call-target metadata to execute existing code inside the compromised Isolated User Mode enclave. The demonstrated result is control of the enclave instance, not a demonstrated Secure Kernel compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.