CVE-2026-83498 patched September 2026: a four-byte fixed-value write in Windows 11's SFAPE.dll VBS enclave escalates to full Isolated User Mode code execution inside lsass.exe, breaking Credential Guard's core isolation promise. Key findings: - The root bug is in SFAPE.dll's exported Initialize function. After the enclave is legitimately initialized, a repeated call writes the fixed DWORD 0xC0000510 (STATUS_ALREADY_INITIALIZED) to request+0x30 with no address validation, giving an attacker a constrained write primitive targeting any 4-byte-aligned location in VTL1 or VTL0 memory. The vulnerable build is SFAPE.dll 10.0.26100.8875 (SHA-256: AEFEDEB6A7F84679C192D3C19F6C08C3E508222574AE5C9E3D0E10FD2DECE4AF); the patch landed in 10.0.26100.9444 via KB5124008 on September 8, 2026. - The four-byte write corrupts the high DWORD of the cached g_enclaveBase pointer stored at SFAPE image RVA 0xE86C. This destroys the IsInsideEnclave range check used by all other exports, opening a TOCTOU path in ClipboardInput: the host process swaps the UNICODE_STRING Buffer and Length fields between the enclave's validation step and its final SecureZeroMemory call, converting the primitive into a controlled memset(ptr, 0, length) anywhere in VTL1. - With the memset primitive, the attacker pivots the credential-context red-black-tree map pointer stored at SFAPE RVA 0xE064 into a VTL0-resident synthetic tree node. This grants a 16-byte VTL1 read (via GetCcAttributes) and a 64-bit VTL1 write (via SetCcTimeStamps), which are used to replace the VertValidTargetTable (VTT) in vertdll, the list of approved CallEnclave targets. Replacing the VTT authorizes arbitrary existing VTL1 functions and ROP gadgets, bypassing VTL1 Arbitrary Code Guard. - NtContinue is then added to the replacement VTT and called via CallEnclave to restore a controlled CONTEXT structure (RIP, RSP, RCX, RDX, R8, R9) captured earlier with RtlCaptureContext. This gives full multi-argument calling convention control over existing VTL1 code, confirmed by exercising vertdll functions with verified argument and return-value control. The Secure Kernel syscall 0x08000019 (EnclaveCopyIntoEnclave / EnclaveCopyOutOfEnclave, at vertdll RVAs 0x4090 and 0x40B0) then provides clean arbitrary VTL1 read/write without the earlier constraints. - The host process for SFAPE.dll is SFAPM.dll, an LSA package loaded by lsass.exe as NT AUTHORITY\SYSTEM. LSA protection is on by default on Windows 11, but an attacker already inside lsass or able to load a crafted enclave host can weaponize this chain. The patched VbsSiPolicy.p7b now blocks all older SFAPE.dll images via VBS Code Integrity policy, so rollback to the vulnerable build is prevented. The vulnerable Edge prefs_enclave_x64.dll (CVE-2023-36880, CVE-2024-21423) remains unblocked by the current policy despite comparable impact. Takeaway: If you are investigating a system running unpatched Windows 11 builds before KB5124008, examine lsass.exe for unexpected enclave allocations and audit which enclave DLLs are loaded into it. Look for anomalous CallEnclave traffic patterns in ETW or kernel telemetry around the SFAPM LSA package. Confirm VbsSiPolicy.p7b has been updated: an outdated policy file is a reliable indicator that older, vulnerable enclave images can still load. The full exploit chain details, decompilation, and RVA offsets are in the Doyensec report. #DFIR_Radar