Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-8536: Windows Defender and related products may crash on malicious file

CVE-2017-8536 · published 9 years ago

Summary

The built‑in anti‑malware engine used by Windows Defender, Forefront, Endpoint Protection, Security Essentials and certain Exchange Server versions can be forced to stop working by a specially crafted file. This would cause the scanner to stop, potentially leaving the system unprotected until it is restarted. Apply the latest security updates from Microsoft to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_defender	All versions `cpe:2.3:a:microsoft:windows_defender:-:::::::*`
microsoft	endpoint_protection	All versions `cpe:2.3:a:microsoft:endpoint_protection:-:::::::*`
microsoft	exchange_server	2013 2016 `cpe:2.3:a:microsoft:exchange_server:2013:-::::::`
microsoft	forefront_endpoint_protection	2010 `cpe:2.3:a:microsoft:forefront_endpoint_protection:-:::::::*`
microsoft	security_essentials	All versions `cpe:2.3:a:microsoft:security_essentials:-:::::::*`
microsoft	system_center_endpoint_protection	All versions `cpe:2.3:a:microsoft:system_center_endpoint_protection:-:::::::*`
microsoft	windows_intune_endpoint_protection	All versions `cpe:2.3:a:microsoft:windows_intune_endpoint_protection::::::::`

Original advisory text

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.

References

http://www.securityfocus.com/bid/98708 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038571 Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8536 Patch Vendor Advisory
https://www.exploit-db.com/exploits/42081/ Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

17% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-369Divide By Zero

CWE-476NULL Pointer Dereference

CWE-674Uncontrolled Recursion

Timeline

Published26 May 2017

Updated25 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-8536 · NVD

Track software like this

Free during beta