EUVD-2026-44030
GHSA-9r74-q979-v6gq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted file must be locally delivered and scanned (AV:L, UI:R) with no attacker privileges (PR:N); memory corruption in the engine yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run arbitrary code by having a maliciously crafted file processed by the scanning engine. The flaw stems from an integer overflow (CWE-190) that corrupts memory during scanning, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Technical ContextAI
The affected component is the Microsoft Malware Protection Engine (mpengine), the core file-scanning engine shared across Microsoft Defender Antivirus, Security Essentials, and related endpoint products (CPE cpe:2.3:a:microsoft:microsoft_malware_protection_engine). The root cause is an integer overflow/wraparound (CWE-190), typically arising when a length, size, or offset field parsed from a crafted file exceeds its integer bounds and wraps, leading to an undersized allocation or out-of-bounds write during unpacking/emulation of the sample. Because the engine parses untrusted file formats automatically and historically runs with high privilege, memory-safety defects in this parsing path are high-value; the 'Buffer Overflow' tag alongside 'Integer Overflow' indicates the wrap ultimately drives a memory-corruption write.
RemediationAI
Patch available per vendor advisory (Microsoft, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012); the Microsoft Malware Protection Engine updates automatically as part of the standard anti-malware definition/engine update channel, so the primary action is to ensure Defender engine and platform updates are current - most endpoints receive the fixed engine within 48 hours of release without manual action. Verify the deployed engine version against the advisory's fixed build and, in air-gapped or update-blocked environments, manually push the updated engine package. As a compensating control while updates propagate, restrict delivery of untrusted files to endpoints (attachment filtering, block risky download sources) to reduce the chance of a crafted sample reaching the scan path; note this does not eliminate risk because on-access scanning may still process locally staged files. Disabling real-time scanning would remove the vulnerable code path but is strongly discouraged as it defeats endpoint protection, so it is not a recommended workaround.
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged att
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', al
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today