Playing It SFAPE: Code Execution in Isolated User Mode

Reddit •/u/nibblesec • October 13, 2026

Doyensec discovered multiple vulnerabilities in SFAPE.dll , a VBS enclave shipped with Windows, and chained them to gain code execution within the enclave in Windows Isolated User Mode (VTL1). The post explores how VBS enclaves work and how memory corruption can undermine their isolation guarantees. Microsoft addressed the reported issue in the September 2026 bulletin under CVE-2026-83498 . submitted by /u/nibblesec [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Code Execution Vulnerability in Windows VBS Enclave Disclosed Security researchers from Doyensec discovered vulnerabilities in SFAPE.dll, a VBS enclave in Windows, allowing local code execution within Isolated User Mode (VTL1). The vulnerabilities were chained to exploit memory corruption, undermining the enclave's isolation guarantees. Microsoft addressed the issue in its September 8, 2026 update, tracked as CVE-2026-83498, with a CVSS score of 7.8, rated as high severity. The attack requires local access, as it cannot be executed remotely, and has not been seen in real-world attacks. The research was published on October 13, 2026, after the patch was released. Microsoft confirmed the flaw was not publicly known before the fix and had not been. 3 sources 46

Extracted Entities

Playing It SFAPE: Code Execution in Isolated User Mode

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)