EUVD-2026-31105
GHSA-f7rp-9ghh-f4gm
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based attackers to corrupt heap memory and run arbitrary code on hosts running the vulnerable scanning engine. The flaw scores CVSS 8.1 with high attack complexity, affects systems by default since Defender is shipped with Windows, and at time of analysis has no public exploit identified, though Microsoft has released a vendor patch via MSRC.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: verify Windows Update and automatic Malware Protection Engine definition updates are enabled organization-wide, and audit any managed systems where updates are blocked or delayed. Within 7 days: distribute the patched Malware Protection Engine through your primary patch management channel (Windows Update, WSUS, SCCM, or Intune). …
Sign in for detailed remediation steps.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today