Introduction
A heap-based buffer overflow in the Microsoft Malware Protection Engine now gives remote attackers a path to code execution on virtually every Windows system running Microsoft Defender. Defender ships enabled by default across all supported versions of Windows, which gives CVE-2026-45584 an unusually broad blast radius across enterprise endpoints, servers, and consumer machines.
Technical Information
Root Cause
The vulnerability is in mpengine.dll, the core scanning, detection, and cleaning library shared by Microsoft Defender, System Center Endpoint Protection, and Microsoft Security Essentials. It is classified as CWE-122 (Heap-based Buffer Overflow), which means the engine writes data beyond the bounds of a heap-allocated buffer while it scans a file.
CVSS Metrics
The full CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value | Description |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the network |
| Attack Complexity (AC) | High | Requires enticing a user to trigger a scan on a quarantined malicious file |
| Privileges Required (PR) | None | No prior authentication or privileges needed |
| User Interaction (UI) | None | Scored as None at the base metric level, though the complexity rating notes that user actions are required to prepare the environment |
| Confidentiality (C) | High | Total loss of information confidentiality |
| Integrity (I) | High | Total compromise of system integrity |
| Availability (A) | High | Total loss of resource availability |
The base score of 8.1 weighs the severe impact (High across all three CIA dimensions) against the elevated attack complexity.
Attack Flow
According to the MSRC advisory, exploitation proceeds like this:
-
Delivery: The attacker sends a specially crafted malicious file to the target system over the network. It could arrive by email, a web download, a file share, or any other network route that places a file on the target.
-
Quarantine: Microsoft Defender flags the file as suspicious and quarantines it. The vulnerability has not been triggered yet.
-
User Interaction: The attacker must entice the local user into several actions that make Defender re-scan the quarantined file. The advisory does not say what those actions are, but this step is what drives the High attack complexity rating.
-
Trigger: When the Malware Protection Engine (
mpengine.dll) processes the crafted file from quarantine, the heap-based buffer overflow fires. It corrupts heap memory in a way that lets the attacker redirect execution flow. -
Code Execution: The attacker runs arbitrary code in the context of the engine process, with full impact on the host's confidentiality, integrity, and availability.
Requiring the file to be quarantined first and then re-scanned through user interaction is a meaningful barrier. In practice, though, social engineering and targeted phishing campaigns can reliably get past it, particularly in enterprise environments.
Patch Information
Microsoft released an official fix on May 19, 2026, through the standard Microsoft Malware Protection Engine update pipeline. The MSRC advisory gives exact version boundaries:
| Component | Vulnerable Version | Fixed Version |
|---|---|---|
| Microsoft Malware Protection Engine | 1.1.26030.3008 and prior | 1.1.26040.8 |
The Remediation Level in the CVSS temporal metrics is Official Fix (RL:O), which means this is a complete vendor solution, not a workaround or interim hotfix.
Automatic Updates
Most environments need no manual action. By default, Microsoft Defender pulls engine and security intelligence updates automatically, multiple times per day. The engine update ships bundled with the security intelligence updates under:
- KB2267602 (for Microsoft Defender)
- KB2461484 (for System Center Endpoint Protection)
Environments where automatic updates work would have received the patched engine shortly after release.
Manual and Enterprise Distribution
Where automatic updates are gated or delayed, administrators can distribute the patched engine through WSUS, Microsoft Configuration Manager (SCCM/MECM), Intune, or a UNC file share. They can also force a manual update on individual hosts:
MpCmdRun.exe -SignatureUpdate
The command pulls the latest signatures and engine, which brings the engine to version 1.1.26040.8 or later.
Verification
To confirm the engine version, administrators can check the "Engine Version" field in the Windows Security app under Virus & threat protection > Protection updates, or query it through PowerShell:
Get-MpComputerStatus | Select-Object AMEngineVersion
A Note on False Positives from Scanners
Third-party vulnerability scanners may still report a system as vulnerable when Microsoft Defender is disabled on it. The scanners find the mpengine.dll binary on disk and flag its version number. Microsoft states that disabled Defender installations are not in an exploitable state, because exploitation requires Defender to actively scan a specially crafted malicious file from quarantine.
Affected Systems and Versions
The vulnerability affects all systems running the Microsoft Malware Protection Engine at version 1.1.26030.3008 or earlier. Affected products and platforms include:
- Windows 11 (versions 24H2, 25H2, 26H1 for x64)
- Windows Server 2025
- Microsoft System Center Endpoint Protection
- Microsoft Security Essentials
Any product or platform that relies on mpengine.dll for scanning is in scope.
Vendor Security History
Microsoft has been named a Leader in the Gartner Magic Quadrant for Endpoint Protection Platforms for six consecutive years as of 2025. Microsoft Defender XDR achieved 100% protection coverage in MITRE Engenuity ATT&CK evaluations, and the company holds Leader positions in four Forrester Wave categories. Even with that record, a critical remote code execution vulnerability was found in the default Windows antimalware engine, which shows how persistently hard complex, widely deployed software is to secure. Three related vulnerabilities disclosed in the same patch cycle (CVE-2026-41091, CVE-2026-45498, CVE-2026-45585) are already being exploited in the wild, which adds to the ongoing pressure on Microsoft's security response.
Threat Intelligence
Microsoft currently lists the exploit code maturity for CVE-2026-45584 as Unproven, and no functional public exploit has been documented.
GovCERT.HK issued a High Threat Security Alert noting that multiple vulnerabilities patched in the same cycle, specifically CVE-2026-41091, CVE-2026-45498, and CVE-2026-45585, are already being exploited in the wild. Because CVE-2026-45584 was disclosed alongside them and affects similar components, the odds that threat actors reverse-engineer the patch into a working exploit are higher.
None of the intelligence cited here attributes the active exploitation of the related CVEs to specific threat actors or APT groups. CVE-2026-45584 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, though CISA has been adding vulnerabilities steadily through April and May 2026. Organizations should watch threat feeds and the CISA KEV catalog for any change in its status.
References
- CVE-2026-45584 Detail, NVD
- CVE-2026-45584, Microsoft Security Update Guide
- Microsoft Defender Antivirus Updates Documentation
- CVE-2026-45584, CVE Feed
- GovCERT.HK High Threat Security Alert (A26-05-33)
- Microsoft: An Industry-Recognized Cybersecurity Leader
- CISA Adds One Known Exploited Vulnerability to Catalog (May 7, 2026)
- CISA Adds Seven Known Exploited Vulnerabilities to Catalog (April 13, 2026)
- CISA Adds Eight Known Exploited Vulnerabilities to Catalog (April 20, 2026)
