https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 18:24:42 +0000 https://vulnerability.circl.lu/sighting/460e247c-9614-4db6-9091-63f995093c53/export {"uuid": "460e247c-9614-4db6-9091-63f995093c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://gist.github.com/alon710/0b2fd1795db753d481a3a1d3bb6906ba", "content": "# CVE-2026-45584: CVE-2026-45584: Heap-Based Buffer Overflow in Microsoft Defender (mpengine.dll)\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-05-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-45584\n\n## Summary\nA comprehensive technical analysis of CVE-2026-45584, a high-severity heap-based buffer overflow in Microsoft Defender's QEX parsing logic. The vulnerability resides within mpengine.dll and allows unauthenticated remote code execution or denial of service when processing crafted archives designed to trigger threat remediation and QEX history logging.\n\n## TL;DR\nAn integer truncation in the Microsoft Malware Protection Engine's QEX parsing logic causes a heap-based buffer under-allocation followed by an out-of-bounds memory write, leading to remote code execution or denial of service with local SYSTEM privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-122 / CWE-190\n- **Attack Vector**: Network / Local File Parsing\n- **CVSS Base Score**: 8.1\n- **EPSS Score**: 0.00852 (Percentile: 54.69%)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **Affected Component**: mpengine.dll (ParseQexResourceRecordList)\n\n## Affected Systems\n\n- Microsoft Malware Protection Engine (mpengine.dll)\n- Microsoft Defender\n- Windows Security Suite\n- **Microsoft Malware Protection Engine**: < 1.1.26040.8 (Fixed in: `1.1.26040.8`)\n\n## Mitigation\n\n- Verify Microsoft Malware Protection Engine is updated to 1.1.26040.8 or subsequent versions.\n- Implement centralized event logging to monitor Event ID 1000 crashes involving MsMpEng.exe and mpengine.dll.\n- Enforce perimeter email and web filtering rules to block archives with extremely deep directory nesting or anomalous path lengths.\n- Ensure critical endpoints run the latest Defender Platform updates to maintain active IOAV verification limits.\n\n**Remediation Steps:**\n1. Verify the current engine version by navigating to Windows Security -> Settings -> About.\n2. If the engine version is lower than 1.1.26040.8, open administrative PowerShell and run Update-MpSignature.\n3. Monitor the system application log for Event ID 1000 crashes indicating mpengine.dll fault offset 0x0000000000b6890b.\n4. Verify the stability of the MsMpEng.exe process after signature updates have finished applying.\n\n## References\n\n- [Microsoft MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45584)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-45584)\n- [Public PoC Repository](https://github.com/96613686/CVE-2026-45584)\n- [Wiz CVE Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-45584)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-45584) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T15:01:32.182790Z"} {"uuid": "460e247c-9614-4db6-9091-63f995093c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://gist.github.com/alon710/0b2fd1795db753d481a3a1d3bb6906ba", "content": "# CVE-2026-45584: CVE-2026-45584: Heap-Based Buffer Overflow in Microsoft Defender (mpengine.dll)\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-05-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-45584\n\n## Summary\nA comprehensive technical analysis of CVE-2026-45584, a high-severity heap-based buffer overflow in Microsoft Defender's QEX parsing logic. The vulnerability resides within mpengine.dll and allows unauthenticated remote code execution or denial of service when processing crafted archives designed to trigger threat remediation and QEX history logging.\n\n## TL;DR\nAn integer truncation in the Microsoft Malware Protection Engine's QEX parsing logic causes a heap-based buffer under-allocation followed by an out-of-bounds memory write, leading to remote code execution or denial of service with local SYSTEM privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-122 / CWE-190\n- **Attack Vector**: Network / Local File Parsing\n- **CVSS Base Score**: 8.1\n- **EPSS Score**: 0.00852 (Percentile: 54.69%)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **Affected Component**: mpengine.dll (ParseQexResourceRecordList)\n\n## Affected Systems\n\n- Microsoft Malware Protection Engine (mpengine.dll)\n- Microsoft Defender\n- Windows Security Suite\n- **Microsoft Malware Protection Engine**: < 1.1.26040.8 (Fixed in: `1.1.26040.8`)\n\n## Mitigation\n\n- Verify Microsoft Malware Protection Engine is updated to 1.1.26040.8 or subsequent versions.\n- Implement centralized event logging to monitor Event ID 1000 crashes involving MsMpEng.exe and mpengine.dll.\n- Enforce perimeter email and web filtering rules to block archives with extremely deep directory nesting or anomalous path lengths.\n- Ensure critical endpoints run the latest Defender Platform updates to maintain active IOAV verification limits.\n\n**Remediation Steps:**\n1. Verify the current engine version by navigating to Windows Security -> Settings -> About.\n2. If the engine version is lower than 1.1.26040.8, open administrative PowerShell and run Update-MpSignature.\n3. Monitor the system application log for Event ID 1000 crashes indicating mpengine.dll fault offset 0x0000000000b6890b.\n4. Verify the stability of the MsMpEng.exe process after signature updates have finished applying.\n\n## References\n\n- [Microsoft MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45584)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-45584)\n- [Public PoC Repository](https://github.com/96613686/CVE-2026-45584)\n- [Wiz CVE Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-45584)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-45584) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T15:01:32.182790Z"} https://vulnerability.circl.lu/sighting/460e247c-9614-4db6-9091-63f995093c53/export Tue, 04 Aug 2026 15:01:32 +0000 https://vulnerability.circl.lu/sighting/02a65102-4940-42e1-b221-1b19cd44c41f/export {"uuid": "02a65102-4940-42e1-b221-1b19cd44c41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmshngckkv2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46727: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-48710: 11 interactions\nCVE-2026-28952: 3 interactions\nCVE-2026-45659: 3 interactions\n", "creation_timestamp": "2026-05-27T02:30:57.574213Z"} {"uuid": "02a65102-4940-42e1-b221-1b19cd44c41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmshngckkv2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46727: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-48710: 11 interactions\nCVE-2026-28952: 3 interactions\nCVE-2026-45659: 3 interactions\n", "creation_timestamp": "2026-05-27T02:30:57.574213Z"} https://vulnerability.circl.lu/sighting/02a65102-4940-42e1-b221-1b19cd44c41f/export Wed, 27 May 2026 02:30:57 +0000 https://vulnerability.circl.lu/sighting/6455a3f6-072c-419d-b1e5-b4bda96336c4/export {"uuid": "6455a3f6-072c-419d-b1e5-b4bda96336c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmpx5qwrnf2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46727: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-26980: 7 interactions\nCVE-2026-44277: 3 interactions\nCVE-2026-5223: 3 interactions\n", "creation_timestamp": "2026-05-26T02:30:32.542858Z"} {"uuid": "6455a3f6-072c-419d-b1e5-b4bda96336c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmpx5qwrnf2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46727: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-26980: 7 interactions\nCVE-2026-44277: 3 interactions\nCVE-2026-5223: 3 interactions\n", "creation_timestamp": "2026-05-26T02:30:32.542858Z"} https://vulnerability.circl.lu/sighting/6455a3f6-072c-419d-b1e5-b4bda96336c4/export Tue, 26 May 2026 02:30:32 +0000 https://vulnerability.circl.lu/sighting/deb17fe3-5a43-49bd-99c4-d61702404d47/export {"uuid": "deb17fe3-5a43-49bd-99c4-d61702404d47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmngpinxe52e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46333: 24 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45250: 8 interactions\nCVE-2026-26980: 6 interactions\nCVE-2026-9082: 4 interactions\n", "creation_timestamp": "2026-05-25T02:30:54.739832Z"} {"uuid": "deb17fe3-5a43-49bd-99c4-d61702404d47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmngpinxe52e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46333: 24 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45250: 8 interactions\nCVE-2026-26980: 6 interactions\nCVE-2026-9082: 4 interactions\n", "creation_timestamp": "2026-05-25T02:30:54.739832Z"} https://vulnerability.circl.lu/sighting/deb17fe3-5a43-49bd-99c4-d61702404d47/export Mon, 25 May 2026 02:30:54 +0000 https://vulnerability.circl.lu/sighting/fb923a69-0931-4dd5-827c-c9cf18d49164/export {"uuid": "fb923a69-0931-4dd5-827c-c9cf18d49164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmkwa6j64z2e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 65 interactions\nCVE-2026-45250: 64 interactions\nCVE-2026-46333: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-69: 18 interactions\nCVE-2026-20223: 3 interactions\nCVE-2026-41091: 3 interactions\n", "creation_timestamp": "2026-05-24T02:30:41.164409Z"} {"uuid": "fb923a69-0931-4dd5-827c-c9cf18d49164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmkwa6j64z2e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 65 interactions\nCVE-2026-45250: 64 interactions\nCVE-2026-46333: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-69: 18 interactions\nCVE-2026-20223: 3 interactions\nCVE-2026-41091: 3 interactions\n", "creation_timestamp": "2026-05-24T02:30:41.164409Z"} https://vulnerability.circl.lu/sighting/fb923a69-0931-4dd5-827c-c9cf18d49164/export Sun, 24 May 2026 02:30:41 +0000 https://vulnerability.circl.lu/sighting/a7a69ace-535a-4467-96d7-07edb1a5b59f/export {"uuid": "a7a69ace-535a-4467-96d7-07edb1a5b59f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmifqkvtg52v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-46333: 28 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46333: 13 interactions\nCVE-2026-31431: 6 interactions\nCVE-2026-39821: 6 interactions\n", "creation_timestamp": "2026-05-23T02:31:24.979107Z"} {"uuid": "a7a69ace-535a-4467-96d7-07edb1a5b59f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmifqkvtg52v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-46333: 28 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46333: 13 interactions\nCVE-2026-31431: 6 interactions\nCVE-2026-39821: 6 interactions\n", "creation_timestamp": "2026-05-23T02:31:24.979107Z"} https://vulnerability.circl.lu/sighting/a7a69ace-535a-4467-96d7-07edb1a5b59f/export Sat, 23 May 2026 02:31:24 +0000 https://vulnerability.circl.lu/sighting/c8413459-f9ed-439b-af35-93e960ed40ef/export {"uuid": "c8413459-f9ed-439b-af35-93e960ed40ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmfvchcwo22h", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-42897: 43 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45250: 63 interactions\nCVE-2026-41091: 8 interactions\nCVE-2026-45498: 8 interactions\n", "creation_timestamp": "2026-05-22T02:30:45.048220Z"} {"uuid": "c8413459-f9ed-439b-af35-93e960ed40ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmfvchcwo22h", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-42897: 43 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45250: 63 interactions\nCVE-2026-41091: 8 interactions\nCVE-2026-45498: 8 interactions\n", "creation_timestamp": "2026-05-22T02:30:45.048220Z"} https://vulnerability.circl.lu/sighting/c8413459-f9ed-439b-af35-93e960ed40ef/export Fri, 22 May 2026 02:30:45 +0000 https://vulnerability.circl.lu/sighting/35bde5f6-ae85-4f66-b6bb-e4b58ba22df1/export {"uuid": "35bde5f6-ae85-4f66-b6bb-e4b58ba22df1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/cadey.pony.social.ap.brid.gy/post/3mmcwma2sy5y2", "content": "\"No way to prevent this\" say users of only language where this regularly happens\n\nhttps://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2026-45584/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon", "creation_timestamp": "2026-05-20T22:18:18.023727Z"} {"uuid": "35bde5f6-ae85-4f66-b6bb-e4b58ba22df1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/cadey.pony.social.ap.brid.gy/post/3mmcwma2sy5y2", "content": "\"No way to prevent this\" say users of only language where this regularly happens\n\nhttps://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2026-45584/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon", "creation_timestamp": "2026-05-20T22:18:18.023727Z"} https://vulnerability.circl.lu/sighting/35bde5f6-ae85-4f66-b6bb-e4b58ba22df1/export Wed, 20 May 2026 22:18:18 +0000 https://vulnerability.circl.lu/sighting/4bc24e58-d05e-4ccd-98e8-d99862b299d0/export {"uuid": "4bc24e58-d05e-4ccd-98e8-d99862b299d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmcpfkz7pv2f", "content": "\ud83d\udccc CVE-2026-45584 - Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. https://www.cyberhub.blog/cves/CVE-2026-45584", "creation_timestamp": "2026-05-20T20:07:07.870808Z"} {"uuid": "4bc24e58-d05e-4ccd-98e8-d99862b299d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmcpfkz7pv2f", "content": "\ud83d\udccc CVE-2026-45584 - Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. https://www.cyberhub.blog/cves/CVE-2026-45584", "creation_timestamp": "2026-05-20T20:07:07.870808Z"} https://vulnerability.circl.lu/sighting/4bc24e58-d05e-4ccd-98e8-d99862b299d0/export Wed, 20 May 2026 20:07:07 +0000 https://vulnerability.circl.lu/sighting/76441c4c-b233-41b5-8963-0126aeb66e9e/export {"uuid": "76441c4c-b233-41b5-8963-0126aeb66e9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-defender-multiple-vulnerabilities_20260521", "content": "", "creation_timestamp": "2026-05-20T18:00:00.000000Z"} {"uuid": "76441c4c-b233-41b5-8963-0126aeb66e9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-45584", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-defender-multiple-vulnerabilities_20260521", "content": "", "creation_timestamp": "2026-05-20T18:00:00.000000Z"} https://vulnerability.circl.lu/sighting/76441c4c-b233-41b5-8963-0126aeb66e9e/export Wed, 20 May 2026 18:00:00 +0000