{
  "id": 14388533,
  "title": "Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave",
  "url": "https://urgent.news/2026/10/14/four-byte-write-and-timing-bug-let-researchers-run-code-in-windows",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T05:52:28.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html"
  },
  "original_language": "en",
  "account": "Researchers have demonstrated a method to execute code within a secured area of Windows known as a VBS enclave, which is typically isolated from the rest of the operating system. This particular enclave, responsible for managing passwords within the Windows anti-phishing feature SmartScreen, was compromised by a flaw discovered and exploited by security researchers from the firm Doyensec. The vulnerability, tracked as CVE-2026-83498, was rated with a serious elevation-of-privilege CVSS score of 7.8 and was addressed in Microsoft's September 8, 2026 software update.\n\nThe researchers introduced a bug in the enclave's initialization process, which allowed them to write a four-byte value to an address under their control. This breach interfered with the enclave's ability to distinguish between its own memory and the host's, enabling a timing-based manipulation that ultimately permitted the execution of attacker-chosen code. This exploit did not involve any external intrusion; instead, it relied on gaining local access to a process like lsass.exe, which has SYSTEM-level privileges.\n\nMicrosoft acknowledged the flaw and provided detailed mitigation steps in their advisory. The update KB5124008 for Windows 11 versions 24H2 and 25H2 contains critical fixes that reinforce the enclave's address validation checks and incorporate a new policy to prevent the compromised SFAPE.dll from loading. Despite this patch, the researchers noted that older versions of the enclave, which have similar security weaknesses, remain unprotected. This means that while the latest update mitigates the specific vulnerability explored in this research, it does not entirely eliminate the risk posed by outdated or alternative vulnerable enclaves.",
  "summary": "Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}