CVE-2021-1647

CVE-2021-1647 is a Microsoft Defender Remote Code Execution vulnerability. Multiple sources indicate it was exploited in the wild before patches were available, affecting Microsoft Defender/Windows Defender. The advisory notes a remote code execution risk; exploitation could allow an attacker to ...

CVE-2017-8540

CVE-2017-8540 affects Microsoft Malware Protection Engine (MMPE) across Forefront/Defender deployments. The weakness arises from a use-after-free in the garbage collection system managing JavaScript objects during scanning of specially crafted files, enabling memory corruption and potential remot...

CVE-2020-1170

CVE-2020-1170 – Cloud Filter arbitrary file creation EOP (Windows) Affected component: Cloud Filter driver, cldflt.sys, on Windows 10 v1803 and later (pre-December 2020 updates). Root cause (as documented by the connected MSF module): the driver did not set IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCE...

CVE-2020-1002

CVE-2020-1002 is an elevation of privilege vulnerability in Microsoft Defender linked to MpSigStub.exe, enabling an attacker who is logged on to delete files in arbitrary locations. The issue requires local access and user interaction-free exploitation via a specially crafted command, with exploi...

CVE-2019-1255

Microsoft Malware Protection Engine Elevation of Privilege (CVE-2019-1255) exists due to improper file handling. An authenticated, remote attacker can exploit this to gain elevated privileges. Affected component: Defender/Malware Protection Engine. Impact: elevation of privilege; exploitation des...

CVE-2020-1163

CVE-2020-1163 is an Elevation of Privilege issue in Windows Defender that can lead to arbitrary file deletion. The exploit requires an authenticated logon to the system. Connected sources confirm the vulnerability affects Windows Defender with the same core description, but do not provide explici...

CVE-2018-0986

CVE-2018-0986 (Microsoft Malware Protection Engine RCE) arises when the engine fails to properly scan a specially crafted file, causing memory corruption. This enables an attacker to execute arbitrary code with Local System privileges on affected systems, potentially taking control. Affected prod...

CVE-2019-1161

Summary: CVE-2019-1161 is a privilege-escalation flaw in Microsoft Defender’s MpSigStub.exe that can enable an attacker to delete protected files at arbitrary locations. What is affected: Defender-related components using MpSigStub.exe (e.g., Windows Defender/Forefront Endpoint Protection suites)...

CVE-2021-24092

CVE-2021-24092 is a Microsoft Defender elevation-of-privilege vulnerability affecting Windows Defender. The connected sources confirm a local, low-privilege attacker could achieve higher privileges (CVE-2021-24092), with a CVSSv3 base score of 7.8 (HIGH) and a local attack vector. Public records ...

CVE-2020-1461

CVE-2020-1461 is a Microsoft Defender elevation of privilege vulnerability in MpSigStub.exe that can allow deletion of files in arbitrary locations. Exploitation requires the attacker to log on to the system, then, with MpSigStub.exe running, execute crafted actions to delete protected files. Mic...

CVE-2012-1459

CVE-2012-1459 affects multiple antivirus products including ClamAV. The issue is a vulnerability in the TAR file parser where a TAR archive entry length field could correspond to the entire entry plus part of the header of the next entry, allowing remote attackers to bypass malware detection. The...

CVE-2012-1457

CVE-2012-1457 affects the TAR file parser in multiple antivirus products (e.g., ClamAV and others) and allows remote attackers to bypass malware detection by crafting a TAR entry whose length exceeds the TAR file size. Connected advisories confirm this issue across vendor updates (e.g., openSUSE ...

CVE-2017-8537

CVE-2017-8537 describes a denial-of-service vulnerability in the Microsoft Malware Protection Engine (MMPE) used with Microsoft Forefront and Microsoft Defender across a range of Windows client/server platforms. The issue arises from MMPE failing to properly scan specially crafted files, which ca...

CVE-2012-1443

CVE-2012-1443 describes a bypass in the RAR file parser used by multiple antivirus products (e.g., ClamAV 0.96.4-related integrations and several vendors) where a RAR file starting with an MZ character sequence can be analyzed by user-assisted remote attackers to bypass malware detection. The evi...

CVE-2017-8558

CVE-2017-8558 affects the Microsoft Malware Protection Engine used by Forefront/Defender on Windows platforms (32‑bit). The vulnerability arises when scanning specially crafted files, leading to memory corruption and remote code execution. Public evidence in multiple feeds confirms this as a remo...

CVE-2017-8535

CVE-2017-8535 affects Microsoft Malware Protection Engine used by Forefront/Defender on Windows platforms. The vulnerability stems from improper scanning of specially crafted files, causing a denial of service. Connected sources also describe similar issues (CVE-2017-8536/7/9/42) in MMPE. Mitigat...

CVE-2017-8536

CVE-2017-8536 is a denial-of-service vulnerability in Microsoft Malware Protection Engine (MMPE) that affects MMPE running on multiple Windows versions and related Microsoft products (Forefront/ Defender). The issue stems from the engine failing to properly scan specially crafted files, which cou...

CVE-2012-1420

The CVE-2012-1420 entry concerns multiple antivirus products (Quick Heal/Cat QuickHeal 11.00; Command Antivirus 5.2.11.5; F-Prot 4.6.2.117; Fortinet 4.2.254.0; K7 9.77.3565; Kaspersky 7.0.0.125; Antimalware Engine 1.1.6402.0; Microsoft Security Essentials 2.0; NOD32 5795; Norman 6.06.12; Panda 10...

CVE-2011-0037

CVE-2011-0037 affects Microsoft Malware Protection Engine (MMPE) prior to 1.1.6603.0, used in MSRT, Windows Defender, Security Essentials, Forefront products, and related tools. The vulnerability allows local privilege escalation through a crafted value of an unspecified user registry key. The do...

CVE-2012-1453

CVE-2012-1453 affects multiple antivirus products whose CAB file parsers can bypass malware detection when a CAB file’s coffFiles field is modified. Affected vendors/products include Dr.Web 5.0.2.03300; Trend Micro HouseCall 9.120.0.1004; Kaspersky Anti-Virus 7.0.0.125; Sophos Anti-Virus 4.61.0; ...