Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-0986

Severity
8.8HIGH
EPSS
75.4%
top 1.11%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedApr 4
Latest updateMay 13

Description

A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages9 packages

CVEListV5microsoft/microsoft_system_center_endpoint_protectionMicrosoft System Center Endpoint Protection
CVEListV5microsoft/windows_intune_endpoint_protectionWindows Intune Endpoint Protection
CVEListV5microsoft/microsoft_system_center2012 Endpoint Protection, 2012 R2 Endpoint Protection+1

Patches

🔴Vulnerability Details

3
GHSA
GHSA-v2gp-f824-rv7r: A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to2022-05-13
CVEList
CVE-2018-0986: A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to2018-04-04
VulnCheck
Microsoft Exchange Server Out-of-bounds Write2018

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows Defender - 'mpengine.dll' Memory Corruption2018-04-05

📋Vendor Advisories

1
Microsoft
Microsoft Malware Protection Engine Remote Code Execution Vulnerability2018-04-10

🕵️Threat Intelligence

1
Tenable
Microsoft Defends Windows Defender from Remote Code Execution: CVE-2018-09862018-04-06
CVE-2018-0986 (HIGH CVSS 8.8) | A remote code execution vulnerabili | cvebase.io