Microsoft Windows Defender

Windows Defender: Improper Authorization in Global Files Search Index
CVE-2024-49071 6.5 - Medium - December 12, 2024

Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.

Improper Authorization of Index Containing Sensitive Information

Nov 2023: Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2023-36422 7.8 - High - November 14, 2023

Microsoft Windows Defender Elevation of Privilege Vulnerability

Untrusted Path

Windows Defender EoP via Improper Resource Access
CVE-2023-38175 7.8 - High - August 08, 2023

Microsoft Windows Defender Elevation of Privilege Vulnerability

Microsoft Defender Elevation of Privilege Vulnerability
CVE-2023-33156 7 - High - July 11, 2023

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft Defender Privilege Escalation Vulnerability
CVE-2023-23389 6.3 - Medium - March 14, 2023

Microsoft Defender Elevation of Privilege Vulnerability

Windows Defender EoP via Privilege Escalation (CVE-2022-37971)
CVE-2022-37971 7.1 - High - October 11, 2022

Microsoft Windows Defender Elevation of Privilege Vulnerability

Windows Defender Credential Guard Feature Bypass Vulnerability
CVE-2022-35822 7.1 - High - August 15, 2022

Windows Defender Credential Guard Security Feature Bypass Vulnerability

Jan 2021: Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-1647 7.8 - High - January 12, 2021

Microsoft Defender Remote Code Execution Vulnerability

An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links
CVE-2020-0835 7.8 - High - April 15, 2020

An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware Platform Hard Link Elevation of Privilege Vulnerability'.

Improper Privilege Management

Aug 2019: Microsoft Defender Elevation of Privilege Vulnerability
CVE-2019-1161 - August 14, 2019

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.

Apr 2018:
CVE-2018-0986 - April 04, 2018

A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly s
CVE-2017-8540 7.8 - High - May 26, 2017

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.

Memory Corruption