Microsoft fixes a Windows Defender remote code execution vulnerability

Costea Lestoc By: Costea Lestoc
2 minute read

Home » News » Microsoft fixes a Windows Defender remote code execution vulnerability

Microsoft recently published the Security Advisory 4022344, announcing a severe security vulnerability in the Malware Protection Engine.

Microsoft Malware Protection Engine

This tool is used by various Microsoft products such as Windows Defender and Microsoft Security Essentials on consumer PCs. It is also used by Microsoft Endpoint Protection, Microsoft Forefront, Microsoft System Center Endpoint Protection, or Windows Intune Endpoint Protection on the business side.

The vulnerability that affected all these products could allow for remote code execution if a program running the Microsoft Malware Protection Engine scanned a crafted file.

Windows Defender vulnerability fixed

Tavis Ormandy and Natalie Silvanovich from Google Project Zero discovered the “worst Windows remote code exec in recent memory” on May 6th, 2017. The researchers told Microsoft about this vulnerability and the information was kept hidden from the public in order to give the company 90 days to fix it.

Microsoft quickly created a patch and pushed out new versions of Windows Defender and more to users.

Windows customers who have the affected products running on their devices must make sure that they’re updated.

Update the program on Windows 10

  • Tap the Windows key, type Windows Defender, and hit Enter to load the program.
  • If you run the Windows 10 Creators Update, you’ll get the new Windows Defender Security Center.
  • Click the cogwheel icon.
  • Select About on the next page.
  • Check the Engine Version to make sure it’s at least 1.1.13704.0.

Windows Defender updates are available through Windows Update. More information on updating Microsoft anti-malware products manually is available on the Malware Protection center on the Microsoft website.

Google vulnerability report on the Project Zero website

Here it is:

Vulnerabilities in MsMpEng are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service.

The core component of MsMpEng responsible for scanning and analysis is called mpengine. Mpengine is a vast and complex attack surface, comprising of handlers for dozens of esoteric archive formats, executable packers and cryptors, full system emulators and interpreters for various architectures and languages, and so on. All of this code is accessible to remote attackers.

NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.


Join our community
windows report logo

Join our community of over 2 million active users and get the latest and most important Windows content on your email address.


Next up

Computer is stuck on 169 IP address [FIX]

Elsie Otachi By: Elsie Otachi
5 minute read

Whenever you find your computer stuck on 169 IP address, this could generally mean either of the following: The DHCP server is temporarily unavailable The […]

Continue Reading

Solve Outlook cannot log on error on Windows 10

Milan Stanojevic avatar. By: Milan Stanojevic
9 minute read

Many users use Outlook as their preferred email client, but sometimes errors such as Outlook cannot log on can appear. This error will prevent you […]

Continue Reading

There was a problem running this tool: Windows 10 Media Creation Tool

Aleksandar Ognjanovic By: Aleksandar Ognjanovic
5 minute read

The software distribution is nowadays mostly digital, and even Microsoft changed they approach with Windows 10. However, Windows 10 Media Creation Tool, the best tool […]

Continue Reading