CVE-2017-8540

Warning

Exploit

EPSS 84.61%
Published 26.05.2017 20:29:00
Last modified 20.04.2025 01:37:25
Source secure@microsoft.com
Teams watchlist Login
Open Login

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.

Affected products Warnungen 1 Metrics 4 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Malware Protection Engine Version >= 1.1.13701.0 < 1.1.13704.0

Microsoft ≫ Endpoint Protection Version-

Microsoft ≫ Exchange Server Version2013 Update-

Microsoft ≫ Exchange Server Version2016 Update-

Microsoft ≫ Forefront Endpoint Protection Version-

Microsoft ≫ Forefront Endpoint Protection Version2010

Microsoft ≫ Forefront Security Version-

Microsoft ≫ Intune Endpoint Protection Version-

Microsoft ≫ Security Essentials Version-

Microsoft ≫ System Center Endpoint Protection Version-

Microsoft ≫ Windows Defender Version-

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability

Vulnerability

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".

Description

Apply updates per vendor instructions.

Required actions

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	84.61%	0.993

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H