SFAPE.dll Flaws Allow Arbitrary Code Execution in Windows VBS Enclave

Researchers at Doyensec found a chain of vulnerabilities in SFAPE.dll, a core component of Windows VBS enclaves running in Isolated User Mode (VTL1). Insufficient input validation and memory management flaws let attackers execute arbitrary code and bypass enclave isolation; Microsoft patched the issue as CVE-2026-83498.

• Flaws in SFAPE.dll allow arbitrary code execution inside VTL1
• Root causes are weak input validation and memory management errors
• Microsoft patched the issue as CVE-2026-83498
• The research was conducted by Doyensec