CVE-2017-8540: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability

Vulnerability summary

CVE-2017-8540 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in Microsoft Malware Protection Engine. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 71.87% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-05-2017
   PublishedVulnerability first disclosed.
2. 03-03-2022
   Added to CISA KEVMicrosoft Malware Protection Engine Improper Restriction of Operations Vulnerability
3. 24-03-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.