CVE-2026-83498

High7.8 Published on Sep 8, 2026

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

CVSS score7.8 / 10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-822

Vendorsmicrosoft

Affected products

Vendors	Product	Versions
microsoft	windows 11 23h2	< 10.0.22631.7582
microsoft	windows 11 24h2	< 10.0.26100.9445
microsoft	windows 11 25h2	< 10.0.26200.9445
microsoft	windows 11 26h1	< 10.0.28000.2954
microsoft	windows server 2025	< 10.0.26100.33438

Vulnerabilities

CVE-2026-83498 Lets Local Attackers Run Code Inside a Windows VBS Enclave

Microsoft fixed CVE-2026-83498 in SFAPE.dll; Doyensec lab research shows low-privilege local code could run inside the VBS enclave, without password theft.

Oct 14, 202609:57 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2026-83498

Affected products

Related articles

CVE-2026-83498 Lets Local Attackers Run Code Inside a Windows VBS Enclave

Audience measurement