Microsoft Defender CVE-2026-45498

No special conditions - remote unauthenticated exploitation against default configurations of Microsoft Defender, whose real-time scanning automatically processes attacker-supplied content (CVSS AV:N/AC:L/PR:N/UI:N). The primary limiting factor is that impact is confined to availability: exploitation crashes or hangs the anti-malware engine but does not by itself grant code execution or data access, and SSVC rates it non-automatable, indicating exploitation is not trivially wormable. Realistic exploitation requires that Defender real-time protection be enabled (the default) and that the crafted input reach the scanning engine.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a purely availability-impacting, remotely reachable, unauthenticated, low-complexity flaw with no confidentiality or integrity loss. CISA KEV confirms active exploitation and SSVC rates exploitation as 'active' with 'partial' technical impact, but marks it 'Automatable: no' - consistent with the moderate EPSS of 2.27% (85th percentile), suggesting targeted rather than mass, wormable use. The signals are aligned rather than conflicting: this is a genuine priority because of confirmed exploitation and ubiquitous deployment, though the impact ceiling is availability only (no code execution or data exposure), so treat it as a high-urgency patch rather than a critical RCE.

An attacker delivers specially crafted content - such as a malicious file over the network or email - that the Defender engine automatically scans, triggering uncontrolled resource consumption that hangs or crashes the anti-malware service. With real-time protection down, the attacker proceeds with malware delivery that would otherwise have been detected. Publicly available exploit code and confirmed in-the-wild exploitation lower the barrier to reproducing this.