Memory corruption in Microsoft Malware Protection Engine
Priority MEDIUM 53CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". This is different than CVE-2017-11937.
Why it matters now
EPSS 0.2051 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Malware Protection Engine | Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016. | — | No fix listed | CNA |
- Microsoft Malware Protection Engine VendorMicrosoft Affected Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016. Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:* | up to 1.1.14306.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2013:*:*:*:*:*:*:* | 2013 | Running on | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:*:*:*:*:*:*:* | 2016 | Running on | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection_2010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1511 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
- cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:* Versions up to 1.1.14306.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2013:*:*:*:*:*:*:* Versions 2013 Running on ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:*:*:*:*:*:*:* Versions 2016 Running on ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection_2010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-11940
- 2026-10-03 Alias added: GHSA-cv79-m93x-rwg8
More Microsoft Malware Protection Engine vulnerabilities
- TI-2026-29727 Microsoft Defender Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2017-06074 Out-of-bounds write in Microsoft Malware Protection Engine KEVCVSS 3.1HIGH 7.8
- TI-2017-00265 Memory corruption in Microsoft Malware Protection Engine CVSS 3.0HIGH 7.8
- TI-2026-48742 Microsoft Defender Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.8
- TI-2026-37344 Microsoft Defender Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.8
- TI-2017-06072 Memory corruption in Microsoft Malware Protection Engine CVSS 3.0HIGH 7.8
Sources
- CVE-2017-11940 · CVE Program
- CVE-2017-11940 · NVD
- FIRST EPSS
- GHSA-cv79-m93x-rwg8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences