EUVD-2026-31102
GHSA-8gp3-pghr-6wxp
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Engine auto-scans remote input so AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H) with no confidentiality or integrity loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Microsoft Defender Denial of Service Vulnerability
Articles & Coverage 1
AnalysisAI
Denial of service in Microsoft Defender Antimalware Platform lets remote unauthenticated attackers exhaust resources and crash or hang the anti-malware engine, disabling real-time protection on affected Windows hosts. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and while its EPSS score is a moderate 2.27% (85th percentile), the KEV listing makes it a priority. Loss of the endpoint's primary anti-malware service creates a window for follow-on intrusion.
Technical ContextAI
Microsoft Defender Antimalware Platform (the mpengine/MsMpEng scanning component distributed via Defender platform updates) is the core anti-malware engine bundled with Windows and Microsoft security products. The root cause is CWE-400 (Uncontrolled Resource Consumption): specially crafted input processed by the scanning engine drives unbounded CPU, memory, or handle consumption until the engine becomes unresponsive or terminates. Because the engine automatically inspects incoming content, an attacker can reach the vulnerable code path over the network without user cooperation.
RemediationAI
Apply the vendor update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498 (Patch available per vendor advisory); the exact fixed platform version is not enumerated in the provided data, so verify the target build against MSRC. The Defender Antimalware Platform typically updates automatically, so confirm that automatic platform updates are enabled and that endpoints have pulled the latest engine build rather than assuming coverage. As a temporary compensating control where patching lags, restrict untrusted inbound content reaching endpoints (for example, filter at the mail and web gateway to reduce hostile inputs the engine scans), accepting that this narrows but does not eliminate exposure; do not disable Defender itself, as that removes protection entirely. Cross-check status against the CISA KEV catalog entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45498) for the required remediation deadline.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today