ZeroDay Findings
Sign inSign up

Findings

CVE-2017-8540

Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability

Published May 26, 2017 · updated Jun 16, 2026 · microsoft malware protection engine

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.

Timeline

Detection, updates, and resolution for this record.

  1. May 26, 2017 · Catalog

    Detected

    The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruptio

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruptio

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe microsoft/endpoint protectionversion unspecified
  • cpe microsoft/exchange server2013
  • cpe microsoft/exchange server2016
  • cpe microsoft/forefront endpoint protectionversion unspecified
  • cpe microsoft/forefront endpoint protection2010
  • cpe microsoft/forefront securityversion unspecified
  • cpe microsoft/intune endpoint protectionversion unspecified
  • cpe microsoft/malware protection engineversion unspecified
  • vendor Microsoft Malware Protection Engineversion unspecified

Sources

  • CISA KEVCVE-2017-8540

    The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruptio

    cisa.gov
  • CVE.orgCVE-2017-8540

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-8540

    30-day exploitation probability 71.9%

    first.org
  • Exploit Database42088

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2017-8540

    The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 20

    nvd.nist.gov

References

CVE-2017-8540 · ZeroDay Findings