{"uuid": "460e247c-9614-4db6-9091-63f995093c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://gist.github.com/alon710/0b2fd1795db753d481a3a1d3bb6906ba", "content": "# CVE-2026-45584: CVE-2026-45584: Heap-Based Buffer Overflow in Microsoft Defender (mpengine.dll)\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-05-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-45584\n\n## Summary\nA comprehensive technical analysis of CVE-2026-45584, a high-severity heap-based buffer overflow in Microsoft Defender's QEX parsing logic. The vulnerability resides within mpengine.dll and allows unauthenticated remote code execution or denial of service when processing crafted archives designed to trigger threat remediation and QEX history logging.\n\n## TL;DR\nAn integer truncation in the Microsoft Malware Protection Engine's QEX parsing logic causes a heap-based buffer under-allocation followed by an out-of-bounds memory write, leading to remote code execution or denial of service with local SYSTEM privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-122 / CWE-190\n- **Attack Vector**: Network / Local File Parsing\n- **CVSS Base Score**: 8.1\n- **EPSS Score**: 0.00852 (Percentile: 54.69%)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **Affected Component**: mpengine.dll (ParseQexResourceRecordList)\n\n## Affected Systems\n\n- Microsoft Malware Protection Engine (mpengine.dll)\n- Microsoft Defender\n- Windows Security Suite\n- **Microsoft Malware Protection Engine**: < 1.1.26040.8 (Fixed in: `1.1.26040.8`)\n\n## Mitigation\n\n- Verify Microsoft Malware Protection Engine is updated to 1.1.26040.8 or subsequent versions.\n- Implement centralized event logging to monitor Event ID 1000 crashes involving MsMpEng.exe and mpengine.dll.\n- Enforce perimeter email and web filtering rules to block archives with extremely deep directory nesting or anomalous path lengths.\n- Ensure critical endpoints run the latest Defender Platform updates to maintain active IOAV verification limits.\n\n**Remediation Steps:**\n1. Verify the current engine version by navigating to Windows Security -> Settings -> About.\n2. If the engine version is lower than 1.1.26040.8, open administrative PowerShell and run Update-MpSignature.\n3. Monitor the system application log for Event ID 1000 crashes indicating mpengine.dll fault offset 0x0000000000b6890b.\n4. Verify the stability of the MsMpEng.exe process after signature updates have finished applying.\n\n## References\n\n- [Microsoft MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45584)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-45584)\n- [Public PoC Repository](https://github.com/96613686/CVE-2026-45584)\n- [Wiz CVE Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-45584)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-45584) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T15:01:32.182790Z"}