CVE-2017-8540: Microsoft Malware Protection Engine out-of-bounds write via crafted file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a public exploit and very high EPSS, but the vector requires local access and user interaction, and the flaw is from 2017 with a vendor patch available.

What it is

The Microsoft Malware Protection Engine, used by Windows Defender, Forefront, Security Essentials, System Center Endpoint Protection, Intune Endpoint Protection and Exchange Server, fails to properly scan a specially crafted file, causing memory corruption. Because the engine runs with high privileges as part of the antimalware service, a successful write primitive can lead to code execution in that context.

Impact

An attacker who gets a crafted file scanned by the engine can corrupt memory and potentially execute arbitrary code with the privileges of the Malware Protection Engine service, which is typically SYSTEM on Windows hosts.

Attack surface

Reached locally by delivering a specially crafted file that the engine scans; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so the victim must cause the file to be scanned, for example by opening or receiving it.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-03 with a 2022-03-24 remediation due date, and EPSS shows a 30-day probability of 0.71961 (99.4th percentile); a public Exploit-DB entry (42088) exists, though no ransomware use is documented.

What to do

• Apply the Microsoft security update for the Malware Protection Engine referenced in the MSRC advisory for CVE-2017-8540.
• Verify the installed engine version is at or above the fixed build across all affected products, including Exchange servers and endpoint protection clients.
• Restrict or filter untrusted file attachments and downloads reaching mail and endpoint scanning paths.
• Where feasible, limit the privileges and exposure of antimalware scanning services on legacy platforms such as Windows Server 2008 and Windows 7.

Detection

• Monitor for crashes or unexpected restarts of the antimalware engine service (MsMpEng) that could indicate malformed-file handling.
• Hunt for processes spawned by the Malware Protection Engine service, which should not normally create child processes.
• Review endpoint telemetry for suspicious files written to disk shortly before engine faults or service restarts.
• Check asset inventory for hosts still running unpatched engine versions on the affected Windows and Exchange platforms.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.