Out-of-bounds write in Microsoft Windows Defender
Priority HIGH 73CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.
Why it matters now
EPSS 0.63268 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Windows Defender | Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows 10 Version 1511 for 32-bit Systems; Windows 10 Version 1511 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows RT 8.1; Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); Windows Server 2012; Windows Server 2012 (Server Core installation); Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); Windows Server 2016; Windows Server 2016 (Server Core installation); Windows Server, version 1709 (Server Core Installation) | — | No fix listed | CNA |
| Microsoft | Windows Intune Endpoint Protection | Windows Intune Endpoint Protection | — | No fix listed | CNA |
| Microsoft | Microsoft Security Essentials | Microsoft Security Essentials | — | No fix listed | CNA |
| Microsoft | Microsoft System Center Endpoint Protection | Microsoft System Center Endpoint Protection | — | No fix listed | CNA |
| Microsoft | Microsoft Exchange Server | 2013; 2016 | — | No fix listed | CNA |
| Microsoft | Microsoft System Center | 2012 Endpoint Protection; 2012 R2 Endpoint Protection | — | No fix listed | CNA |
| Microsoft | Microsoft Forefront Endpoint Protection | 2010 | — | No fix listed | CNA |
- Windows Defender VendorMicrosoft Affected Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows 10 Version 1511 for 32-bit Systems; Windows 10 Version 1511 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows RT 8.1; Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation); Windows Server 2012; Windows Server 2012 (Server Core installation); Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); Windows Server 2016; Windows Server 2016 (Server Core installation); Windows Server, version 1709 (Server Core Installation) Fixed in — No fix listed CNA
- Windows Intune Endpoint Protection VendorMicrosoft Affected Windows Intune Endpoint Protection Fixed in — No fix listed CNA
- Microsoft Security Essentials VendorMicrosoft Affected Microsoft Security Essentials Fixed in — No fix listed CNA
- Microsoft System Center Endpoint Protection VendorMicrosoft Affected Microsoft System Center Endpoint Protection Fixed in — No fix listed CNA
- Microsoft Exchange Server VendorMicrosoft Affected 2013; 2016 Fixed in — No fix listed CNA
- Microsoft System Center VendorMicrosoft Affected 2012 Endpoint Protection; 2012 R2 Endpoint Protection Fixed in — No fix listed CNA
- Microsoft Forefront Endpoint Protection VendorMicrosoft Affected 2010 Fixed in — No fix listed CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* | 2013 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_endpoint_protection_2010:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:intune_endpoint_protection:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_endpoint_protection:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:-:*:*:*:*:*:* | 2012 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:r2:*:*:*:*:*:* | 2012 r2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:* Versions 2013 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_endpoint_protection_2010:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:intune_endpoint_protection:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_endpoint_protection:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:-:*:*:*:*:*:* Versions 2012 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:r2:*:*:*:*:*:* Versions 2012 r2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1511 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0986
- 2026-10-03 Alias added: GHSA-v2gp-f824-rv7r
References
More Microsoft Exchange Server vulnerabilities
- TI-2024-14170 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2022-19610 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-13547 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-13502 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-08465 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07929 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2018-0986 · CVE Program
- CVE-2018-0986 · NVD
- FIRST EPSS
- GHSA-v2gp-f824-rv7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences