Vulnerability record · CVE-2017-0290 · published 9 May 2017
CVE-2017-0290: Microsoft Malware Protection Engine memory corruption RCE
Microsoft · Forefront Security
The Microsoft Malware Protection Engine, used by Windows Defender and Forefront, fails to properly scan a specially crafted file, causing memory corruption. Because the engine runs with high privileges and scans files automatically, a malformed file can trigger code execution without the user opening it.
Description
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability."
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityHigh CVSS (7.8), very high EPSS, and public exploit code make this a serious risk despite no KEV listing.
What it is
The Microsoft Malware Protection Engine, used by Windows Defender and Forefront, fails to properly scan a specially crafted file, causing memory corruption. Because the engine runs with high privileges and scans files automatically, a malformed file can trigger code execution without the user opening it.
Impact
An attacker can execute arbitrary code in the context of the Malware Protection Engine, which typically runs as SYSTEM, leading to full compromise of the affected host.
Attack surface
Reached by getting a crafted file onto the target so the engine scans it; the CVSS vector is local with user interaction (AV:L/UI:R), but public reporting describes the scan as automatic, so no deliberate user action beyond file delivery may be needed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.814 (99.6th percentile) and multiple references are tagged Exploit, including Project Zero and Exploit-DB, indicating public exploit code exists.
What to do
- Apply the Microsoft Malware Protection Engine update referenced in Microsoft advisory 4022344 immediately.
- Verify the engine version on all Windows Defender and Forefront endpoints after patching.
- Restrict or filter untrusted file delivery paths (email attachments, downloads, removable media) that feed the scanning engine.
- Where patching is delayed, consider disabling real-time scanning of untrusted locations as a temporary compensating control.
Detection
- Monitor for unexpected process creation or crashes originating from MsMpEng.exe.
- Alert on Malware Protection Engine version strings older than the fixed build.
- Review endpoint logs for scanning activity tied to unusual or newly delivered files.
- Hunt for post-exploitation behavior from SYSTEM-level processes spawned by the AV engine.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-0290 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0290), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
