EUVD-2026-31101
GHSA-h776-j9jw-992p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Articles & Coverage 2
AnalysisAI
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged attacker to elevate to SYSTEM by abusing improper link resolution (CWE-59) before file access. The flaw scores CVSS 7.8 with high impact to confidentiality, integrity, and availability, and no public exploit is identified at time of analysis. Microsoft has released a patch via MSRC, and there is no current CISA KEV listing or EPSS signal indicating active mass exploitation.
Technical ContextAI
The Microsoft Malware Protection Engine (mpengine) is the core scanning component shared across Defender Antivirus, Microsoft Security Essentials, and related Microsoft endpoint security products on Windows. CWE-59 (Improper Link Resolution Before File Access, or 'link following') means the engine performs a privileged file operation against a path without first verifying that the path does not traverse a symbolic link, junction, or hardlink controlled by a lower-privileged user. Because the engine runs with elevated privileges (typically SYSTEM) when scanning, writing, quarantining, or remediating files, an attacker who can plant a junction or symlink in a directory the engine touches can redirect that privileged file I/O to a target the attacker otherwise could not modify, yielding privilege escalation on the local host.
RemediationAI
Patch available per vendor advisory - apply the Microsoft Malware Protection Engine update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091; the engine normally updates automatically within 48 hours via Microsoft Update / Defender definition channels, so verify that automatic engine updates are enabled and confirm the post-patch engine version on managed endpoints via Get-MpComputerStatus (AMEngineVersion) or your EDR/MDM inventory. In environments where automatic updates are blocked, push the engine update through WSUS, SCCM, Intune, or your standard Windows patching pipeline and confirm rollout. Until the updated engine is confirmed deployed, compensating controls are limited because Defender's scan paths are not user-configurable; you can reduce exposure on multi-user systems by restricting interactive logon to trusted users and tightening permissions on world-writable directories that Defender scans (e.g., %TEMP%, %ProgramData%) to inhibit junction/symlink planting, with the trade-off of potential breakage for legitimate software that writes there. Do not disable Defender as a workaround, as that removes baseline protection against far more prevalent threats.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today