DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-45584: CVE-2026-45584: Heap-Based Buffer Overflow in Microsoft Defender (mpengine.dll)

#security #cve #cybersecurity

CVE-2026-45584: Heap-Based Buffer Overflow in Microsoft Defender (mpengine.dll)

Vulnerability ID: CVE-2026-45584
CVSS Score: 8.1
Published: 2026-05-20

A comprehensive technical analysis of CVE-2026-45584, a high-severity heap-based buffer overflow in Microsoft Defender's QEX parsing logic. The vulnerability resides within mpengine.dll and allows unauthenticated remote code execution or denial of service when processing crafted archives designed to trigger threat remediation and QEX history logging.

TL;DR

An integer truncation in the Microsoft Malware Protection Engine's QEX parsing logic causes a heap-based buffer under-allocation followed by an out-of-bounds memory write, leading to remote code execution or denial of service with local SYSTEM privileges.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-122 / CWE-190
  • Attack Vector: Network / Local File Parsing
  • CVSS Base Score: 8.1
  • EPSS Score: 0.00852 (Percentile: 54.69%)
  • Impact: Remote Code Execution (RCE) / Denial of Service (DoS)
  • Exploit Status: Proof-of-Concept (PoC) Available
  • Affected Component: mpengine.dll (ParseQexResourceRecordList)

Affected Systems

  • Microsoft Malware Protection Engine (mpengine.dll)
  • Microsoft Defender
  • Windows Security Suite
  • Microsoft Malware Protection Engine: < 1.1.26040.8 (Fixed in: 1.1.26040.8)

Exploit Details

  • GitHub: Public diagnostic and reproduction repository containing a crashing PoC and crash dump analysis.

Mitigation Strategies

  • Verify Microsoft Malware Protection Engine is updated to 1.1.26040.8 or subsequent versions.
  • Implement centralized event logging to monitor Event ID 1000 crashes involving MsMpEng.exe and mpengine.dll.
  • Enforce perimeter email and web filtering rules to block archives with extremely deep directory nesting or anomalous path lengths.
  • Ensure critical endpoints run the latest Defender Platform updates to maintain active IOAV verification limits.

Remediation Steps:

  1. Verify the current engine version by navigating to Windows Security -> Settings -> About.
  2. If the engine version is lower than 1.1.26040.8, open administrative PowerShell and run Update-MpSignature.
  3. Monitor the system application log for Event ID 1000 crashes indicating mpengine.dll fault offset 0x0000000000b6890b.
  4. Verify the stability of the MsMpEng.exe process after signature updates have finished applying.

References

Read the full report for CVE-2026-45584 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)