EUVD-2026-44029
GHSA-9gvv-f74q-gxrr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be scanned by the engine (AV:L, UI:R), no privileges needed (PR:N), and SYSTEM-level engine execution yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-191) that a local attacker can trigger with no prior authentication but requiring user interaction, yielding high confidentiality, integrity, and availability impact. Because Defender's scanning engine runs with SYSTEM-level privileges, successful exploitation would grant full compromise of the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Microsoft has released a fix.
Technical ContextAI
The affected component is the Microsoft Malware Protection Engine (mpengine.dll), the shared scanning core behind Microsoft Defender Antivirus, Security Essentials, and related endpoint products. The root cause is CWE-191 (integer underflow/wraparound): an arithmetic operation subtracts past zero and wraps to a very large unsigned value, which typically leads to undersized buffer allocations or out-of-bounds reads/writes when the engine parses attacker-influenced content. Antimalware engines are historically high-value targets because they automatically and often eagerly parse untrusted file formats (archives, executables, scripts) at maximum privilege, so a parsing arithmetic error translates directly into memory-corruption-grade impact. The single CPE provided (cpe:2.3:a:microsoft:microsoft_malware_protection_engine) confirms the engine itself, rather than a specific Defender UI or platform build, is the vulnerable unit.
RemediationAI
Patch available per vendor advisory: ensure the Microsoft Malware Protection Engine updates to the fixed build referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011. In most environments no manual action is required because the engine auto-updates alongside security intelligence definitions, typically within 48 hours; verify by confirming the engine version in Windows Security under 'About' (or via Get-MpComputerStatus reporting AMEngineVersion) matches or exceeds the version cited in the advisory. For managed or air-gapped fleets that disable automatic engine updates, manually push the updated engine through WSUS, Microsoft Configuration Manager, or the standalone definition package. As an interim compensating control where updating is delayed, reduce untrusted-file exposure to the scanner - for example restrict inbound file transfer paths and email attachment delivery - but note this does not remove the vulnerability and degrades protection, so it should only bridge the short gap before the engine update lands.
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged att
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', al
Same weakness CWE-191 – Integer Underflow
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today