Ethical Hacking News
Researchers at Doyensec have discovered a previously unknown vulnerability in Windows SmartScreen, allowing attackers to execute arbitrary code within the SmartScreen enclave. The vulnerability, tracked as CVE-2026-83498, was fixed by Microsoft in its September 2026 cumulative update, but researchers have noted that the fix may not prevent the enclave from loading at all. This discovery highlights the importance of ongoing security research and testing.
Researchers at Doyensec discovered a previously unknown vulnerability in Windows SmartScreen, allowing attackers to execute arbitrary code within the SmartScreen enclave. The vulnerability, CVE-2026-83498, allows an attacker to write arbitrary data to the enclave's memory and execute arbitrary code by exploiting a timing bug in the enclave's initialization function. The vulnerability can bypass the enclave's isolation mechanisms, effectively allowing an attacker to replace the enclave's table of trusted code with malicious code. The vulnerability was fixed by Microsoft in its September 8, 2026, cumulative update, KB5124008, but some researchers have noted potential gaps in the system's security.
A recent discovery by researchers at the security firm Doyensec has shed light on a previously unknown vulnerability in Windows SmartScreen, a feature designed to protect users from phishing attacks and other malicious activities. The vulnerability, tracked as CVE-2026-83498, allows attackers to execute arbitrary code within the SmartScreen enclave, a protected area of the operating system that is meant to remain isolated from the rest of the system.
The SmartScreen enclave is a critical component of Windows SmartScreen, responsible for storing and verifying user credentials, including passwords. The enclave is protected by a combination of hardware and software mechanisms, including the Windows hypervisor, which separates the enclave's memory from the rest of the system. However, researchers at Doyensec have discovered a critical flaw in the enclave's design, which allows an attacker to write arbitrary data to the enclave's memory and execute arbitrary code.
The vulnerability is triggered by a timing bug in the enclave's initialization function, which allows an attacker to control the timing of the function's execution. By carefully controlling the timing of the function's execution, an attacker can write arbitrary data to the enclave's memory and execute arbitrary code. This allows the attacker to replace the enclave's table of trusted code with malicious code, effectively bypassing the enclave's isolation mechanisms.
The researchers at Doyensec discovered the vulnerability by building an attack from a small mistake and widening it step by step. They found that calling the enclave's Initialize function a second time makes it write a fixed four-byte error value to an address controlled by the calling program. This allows the attacker to corrupt the value the enclave uses to tell its own memory from the host's, effectively disabling the enclave's safety check. From there, a timing bug in another function triggers a controlled wipe, which redirects how the enclave looks up a stored object, and the resulting read and write let the attackers replace the table that decides which code the enclave may run.
The result of this vulnerability is that an attacker can execute arbitrary code within the SmartScreen enclave, effectively bypassing the enclave's isolation mechanisms. This has significant implications for the security of Windows systems, as the SmartScreen enclave is a critical component of the operating system's security infrastructure.
Microsoft has since fixed the vulnerability in its September 8, 2026, cumulative update, KB5124008, for Windows 11 versions 24H2 and 25H2. However, researchers have noted that the fix may not prevent the enclave from loading at all, leaving a potential gap in the system's security. Furthermore, the September policy only blocks the old SFAPE file, while an older Microsoft Edge enclave with a similar read-and-write flaw, CVE-2023-36880, is still allowed to load.
The discovery of this vulnerability highlights the importance of ongoing security research and testing. As the threat landscape continues to evolve, it is essential for security researchers and developers to remain vigilant and proactive in identifying and addressing vulnerabilities. The Doyensec researchers' discovery is a prime example of the critical work being done in the security research community, and their findings serve as a reminder of the importance of staying vigilant in the pursuit of security.
Related Information:
https://www.ethicalhackingnews.com/articles/Breaking-the-Enclave-Uncovering-the-Four-Byte-Write-and-Timing-Bug-that-Exposed-a-Critical-Windows-SmartScreen-Vulnerability-ehn.shtml
https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-83498
https://www.cvedetails.com/cve/CVE-2026-83498/
https://nvd.nist.gov/vuln/detail/CVE-2023-36880
https://www.cvedetails.com/cve/CVE-2023-36880/
Published: Wed Oct 14 03:11:40 2026 by llama3.2 3B Q4_K_M
