EUVD-2026-44030
GHSA-9r74-q979-v6gq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted file must be locally delivered and scanned (AV:L, UI:R) with no attacker privileges (PR:N); memory corruption in the engine yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run arbitrary code by having a maliciously crafted file processed by the scanning engine. The flaw stems from an integer overflow (CWE-190) that corrupts memory during scanning, yielding full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Microsoft Malware Protection Engine to scan an attacker-supplied, specially crafted file, and the CVSS vector's UI:R indicates a user-triggered action (e.g., downloading, opening, or otherwise causing the file to be scanned) is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - local attack vector with low complexity, no privileges required, but user interaction needed, and high impact across CIA. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious file that triggers the integer overflow when parsed by the Malware Protection Engine and delivers it to a victim via email, download, or file share. When the file is written to disk or opened and Defender scans it (the required user interaction), the overflow corrupts engine memory and executes attacker-controlled code in the scanning context. … |
| Remediation | Patch available per vendor advisory (Microsoft, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012); the Microsoft Malware Protection Engine updates automatically as part of the standard anti-malware definition/engine update channel, so the primary action is to ensure Defender engine and platform updates are current - most endpoints receive the fixed engine within 48 hours of release without manual action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows systems running Microsoft Defender and document current Malware Protection Engine versions using endpoint management tools or WSUS reports. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today