Out-of-bounds write in Microsoft Malware Protection Engine
Priority CRITICAL 93Exploited in the wildCWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
Why it matters now
Exploitation Active In CISA KEV since 2022-03-03CISA due date 2022-03-24
EPSS 0.71874 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Malware Protection Engine | Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016. | — | No fix listed | CNA |
- Malware Protection Engine VendorMicrosoft Affected Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016. Fixed in — No fix listed CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:* | 1.1.13701.0 to before 1.1.13704.0 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | r2 sp1 | Running on | Microsoft |
- cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:* Versions 1.1.13701.0 to before 1.1.13704.0 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* | 2013 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:* | 2010 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_security:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:intune_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* Versions 2013 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:* Versions 2010 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_security:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:intune_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-03-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2017-8540
- 2026-10-03 Alias added: GHSA-342q-x494-83vw
References
More Microsoft Endpoint Protection vulnerabilities
- TI-2017-06091 Memory corruption in Microsoft Malware Protection Engine CVSS 3.0HIGH 7.8
- TI-2017-06071 Memory corruption in Microsoft Malware Protection Engine CVSS 3.1MEDIUM 5.5
- TI-2017-06070 Memory corruption in Microsoft Malware Protection Engine CVSS 3.1MEDIUM 5.5
- TI-2017-06069 Memory corruption in Microsoft Malware Protection Engine CVSS 3.1MEDIUM 5.5
- TI-2021-06388 Microsoft Defender Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.8
Sources
- CVE-2017-8540 · CVE Program
- CVE-2017-8540 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-342q-x494-83vw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences