CVE-2017-8541: Microsoft Malware Protection Engine memory corruption via crafted file scan

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.8) with memory corruption in a privileged security component, public exploit code, and very high EPSS, though not in KEV and requiring file delivery or user interaction.

What it is

The Microsoft Malware Protection Engine, used by Forefront and Windows Defender across many Windows versions plus Exchange Server 2013 and 2016, fails to properly scan a specially crafted file, causing memory corruption. Because the engine runs with high privileges on endpoints and mail servers, a successful exploit can lead to code execution in a security-critical component.

Impact

An attacker who gets a crafted file scanned by the engine can corrupt memory and potentially execute arbitrary code in the context of the Malware Protection Engine process. This can compromise the host or mail server and may allow disabling or subverting the very protection meant to stop malware.

Attack surface

Reached when the engine scans a malicious file, which on a workstation typically requires a user to open or receive the file (UI:R), while on Exchange or other server-side scanning paths the file may be processed without direct user action. The CVSS vector is local with no privileges required, reflecting that the trigger is file processing rather than a network service.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.48 (98.8th percentile) and a public Exploit-DB entry (42092) exists, indicating exploit code is available though no confirmed widespread exploitation is documented in this record.

What to do

• Apply the Microsoft security update for the Malware Protection Engine referenced in the vendor advisory as soon as possible.
• Verify engine version on all affected Windows, Forefront, Defender, and Exchange 2013/2016 systems and force an engine update if the fixed build is not present.
• Restrict or disable automatic scanning of untrusted file sources where operationally feasible, and block risky attachment types at the mail gateway.
• Limit user ability to open files from untrusted origins and enforce attachment filtering on Exchange.
• Monitor vendor advisories for follow-up engine updates, since the engine updates independently of the OS.

Detection

• Alert on unexpected crashes or restarts of MsMpEng.exe or related antimalware service processes.
• Monitor for suspicious child processes or unusual network connections originating from the Malware Protection Engine process.
• Track engine version inventory to identify hosts still running vulnerable builds.
• Review Exchange and endpoint logs for repeated scan failures or anomalous file handling around crafted attachments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.