Microsoft patches remote code-execution vulnerability discovered in its malware protection engine which is used in nearly every version of Windows
PCs can be compromised when Defender scans an e-mail or IM; patch has been issued. — Microsoft on Monday patched a severe code-execution vulnerability …
Context & Ripple Effects
This is not Microsoft's first trip around the Malware Protection Engine. A year later it would patch another critical remote code-execution flaw in the same component used by Windows Defender and Security Essentials ([[a:928245]]), and in 2021 researchers found a Windows Defender bug that had sat unpatched for twelve years. The pattern: the software positioned as the last line of defense keeps turning into an entry point.
The trigger here is what makes it severe — no user click required. An email or instant message only has to be scanned by Defender for the machine to be exposed, which puts the vulnerability in the same class as the drive-by Internet Explorer flaws Microsoft has repeatedly issued emergency patches for ([[a:832006]], [[a:936789]]).
First-order effects
- Every Windows user running Defender — effectively the default on nearly all versions of Windows — is exposed until the patch lands, and attackers need only deliver a crafted file that gets scanned.
- Microsoft's Patch Tuesday rhythm is broken again: like its earlier out-of-band IE fixes, this fix cannot wait for the monthly cycle because the attack surface is the scanner itself.
Second-order effects
- Enterprises lose the assumption that endpoint antivirus is a trusted backstop — a compromised protection engine sits inside the trust boundary, so defenders must treat their own security tooling as part of the attack surface and patch it on emergency timelines.
Third-order effects
- Because one malware-scanning engine ships across nearly every Windows version, each engine flaw is a monoculture event: if the recurrence seen here (2017, 2018, and a decade-old Defender bug later) holds, pressure will grow for defense-in-depth architectures that don't concentrate trust in a single vendor's scanner.
The trend: Endpoint security software is becoming a recurring attack vector in its own right, with Microsoft's protection engine cycling through critical remote code-execution flaws faster than the monthly patch cycle can absorb.