CVE-2017-8558

🗓️ 29 Jun 2017 13:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 83 Views🌐 WEB

Microsoft Malware Protection Engine Remote Code Execution Vulnerability on Microsoft Window

Reporter	Title	Published	Views	Family All 15
zdt	Microsoft MsMpEng - mpengine x86 Emulator Heap Corruption in VFS API Exploit	28 Jun 201700:00	–	zdt
circl	CVE-2017-8558	27 Jun 201700:00	–	circl
cnvd	Microsoft Malware Protection Engine Remote Code Execution Vulnerability	26 Jun 201700:00	–	cnvd
checkpoint_advisories	Microsoft Malware Protection Engine VFS API Remote Code Execution (CVE-2017-8558)	26 Jun 201700:00	–	checkpoint_advisories
cvelist	CVE-2017-8558	29 Jun 201713:00	–	cvelist
kaspersky	KLA11057 Arbitrary code execution vulnerability in Microsoft Malware Protection Engine	23 Jun 201700:00	–	kaspersky
kaspersky	KLA11843 ACE vulnerability in Microsoft System Center	23 Jun 201700:00	–	kaspersky
nessus	Microsoft Malware Protection Engine < 1.1.13903 RCE	23 Jun 201700:00	–	nessus
mscve	Microsoft Malware Protection Engine Remote Code Execution Vulnerability	23 Jun 201707:00	–	mscve
nvd	CVE-2017-8558	29 Jun 201713:29	–	nvd

NVD

Node

AND

microsoft windows_defenderMatch-

microsoft windows_10Match-x86

microsoft windows_10Match1511x86

microsoft windows_10Match1607x86

microsoft windows_10Match1703x86

microsoft windows_7Match-sp1x86

microsoft windows_8.1Match-x86

microsoft windows_server_2008Match-sp2x86

Node

microsoft endpoint_protectionMatch-

microsoft forefront_endpoint_protectionMatch-

microsoft forefront_endpoint_protectionMatch2010

microsoft security_essentialsMatch-

microsoft windows_intune_endpoint_protectionMatch-

[
  {
    "product": "Microsoft Malware Protection Engine",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "32-bit versions only of Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016."
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1038784
securityfocus	www.securityfocus.com/bid/99262
exploit-db	www.exploit-db.com/exploits/42264/
securitytracker	www.securitytracker.com/id/1038783
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8558

Parameter	Position	Path	Description	CWE
1	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
Buf	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0xffffffff	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
1	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
Buf	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0x7ff	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0x41414141	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119
0	path	mpengine.dll/VFS_Write	Memory corruption through VFS_Write API in mpengine via MpApiCall, leading to arbitrary read/write.	CWE-119

17 Jun 2026 01:26Current

7.5High risk

Vulners AI Score7.5

CVSS 37.8

CVSS 29.3

EPSS0.43588

CWE-119