EUVD-2026-31105
GHSA-f7rp-9ghh-f4gm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target running Defender
-
DeliveryCraft malformed scanner-trigger file
-
ExploitDeliver via email, web, or share
-
ExecutionDefender auto-scans file on arrival
-
PersistHeap overflow triggers in mpengine
-
ImpactExecute code in engine process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target system runs the Microsoft Malware Protection Engine with real-time scanning enabled (the default on Windows endpoints) and that the attacker-supplied file reaches a location the engine scans - for example an email attachment, web download, SMB share, or USB drop - which Defender will then process automatically without user action. The CVSS AC:H component indicates a non-trivial additional condition such as winning a heap-state race or meeting a specific parser code path, meaning exploitation is not push-button reliable; conversely, PR:N and UI:N mean no credentials and no click are required once the file is delivered. Exploitation is limited on systems where Defender real-time protection is disabled or replaced by a third-party AV, on air-gapped hosts not receiving files from untrusted sources, and on engine builds at or above the MSRC-listed fixed version. |
| Impact | Signals are mixed but lean toward priority remediation. CVSS 8.1 with AV:N/PR:N/UI:N indicates a remote, pre-auth, no-interaction attack surface with full CIA impact, but AC:H tempers this - successful exploitation likely requires meeting specific memory-layout or input conditions, which is consistent with anti-malware engine bugs that depend on crafted file structures. The flaw is not listed in CISA KEV and no public exploit was identified at time of analysis, and no EPSS or SSVC data was provided, so widespread opportunistic exploitation cannot be confirmed. However, the engine's automatic, default-on scanning behavior across the Windows ecosystem means a working exploit would have an enormous blast radius, so the high CVSS plus vendor-confirmed patch should drive prompt rollout even absent in-the-wild reports. EPSS, KEV, and POC data are absent from the input rather than disproven, so this assessment may shift as more telemetry surfaces. |
| Exploit ScenarioDerived | An attacker emails a crafted file or hosts it on a web page the target visits; Microsoft Defender's real-time protection automatically scans the file on arrival, the malformed structure triggers a heap overflow in the parsing routine, and the attacker gains code execution in the high-privilege engine process without any user interaction or click. Because AC:H applies, the attacker may need to land the file multiple times or tailor it to heap state, but no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based attackers to corrupt heap memory and run arbitrary code on hosts running the vulnerable scanning engine. The flaw scores CVSS 8.1 with high attack complexity, affects systems by default since Defender is shipped with Windows, and at time of analysis has no public exploit identified, though Microsoft has released a vendor patch via MSRC.
RemediationAI
Patch available per vendor advisory: ensure the Microsoft Malware Protection Engine is updated to the fixed build documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45584; in most deployments this update is delivered automatically through Microsoft Update or the Defender definition channel, typically within 48 hours, so verify that automatic engine updates are enabled and that managed endpoints have actually received the new engine version via Get-MpComputerStatus or the Defender admin console. Where automatic updates are disabled or air-gapped, manually distribute the updated engine through WSUS, SCCM, or Intune. As a temporary compensating control on systems that cannot be updated quickly, restrict ingress of untrusted files (block external email attachments at the gateway, disable SMB inbound, restrict web download paths) - note the trade-off that this reduces but does not eliminate exposure since Defender also scans files generated locally, and disabling real-time scanning is strongly discouraged because it removes baseline protection against unrelated threats.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the Microsoft Malware Protection Engine (mpengine), the core component used by Microsoft Defender, System Center Endpoint Protection, and related Microsoft anti-malware products to parse and scan files. The CWE-122 classification points to a heap-based buffer overflow, meaning the engine writes past the bounds of a dynamically allocated buffer - typically while parsing attacker-controlled file content during automatic scanning. Because mpengine runs with high privileges and scans content from many delivery channels (email, web downloads, SMB shares) without user action, overflow conditions in its parsers historically yield powerful remote code execution primitives. The CPE cpe:2.3:a:microsoft:microsoft_malware_protection_engine identifies the affected component as the engine itself, which is updated separately from Windows via the Defender definition/engine update channel.
Know when Microsoft Malware Protection Engine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Defender, the antimalware engine deployed by default on every Windows device, contains a remote code execution vulnerability (CVSS 8.1) exploitable without credentials. This exposes organizations' entire Windows fleet to compromise by attackers capable of subverting the security controls intended to protect them.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged att
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', al
Exploit-DB