Memory corruption in Microsoft Malware Protection Engine
Priority MEDIUM 42CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8536, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
Why it matters now
EPSS 0.16829 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Malware Protection Engine | Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016. | — | No fix listed | CNA |
- Malware Protection Engine VendorMicrosoft Affected Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016. Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1511 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* | r2 sp1 | Running on | Microsoft |
- cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* | 2013 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:* | 2010 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_intune_endpoint_protection:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* Versions 2013 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:* Versions 2010 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_intune_endpoint_protection:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8535
- 2026-10-03 Alias added: GHSA-h2pr-84p4-xhj2
References
More Microsoft Endpoint Protection vulnerabilities
- TI-2017-06074 Out-of-bounds write in Microsoft Malware Protection Engine KEVCVSS 3.1HIGH 7.8
- TI-2017-06091 Memory corruption in Microsoft Malware Protection Engine CVSS 3.0HIGH 7.8
- TI-2017-06071 Memory corruption in Microsoft Malware Protection Engine CVSS 3.1MEDIUM 5.5
- TI-2017-06070 Memory corruption in Microsoft Malware Protection Engine CVSS 3.1MEDIUM 5.5
- TI-2021-06388 Microsoft Defender Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.8
Sources
- CVE-2017-8535 · CVE Program
- CVE-2017-8535 · NVD
- FIRST EPSS
- GHSA-h2pr-84p4-xhj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences