CVE-2026-45498: Microsoft Defender -- Denial of Service via Malformed Input

Background

Microsoft Defender Antivirus (formerly Windows Defender) is the built-in endpoint protection platform shipped with all modern versions of Microsoft Windows. It provides real-time malware scanning, behavioral monitoring, cloud-based threat intelligence integration, and integration with Microsoft Defender for Endpoint for enterprise environments. Because it is included by default with Windows and requires no additional licensing for basic functionality, Defender is the most widely deployed antivirus solution in the world — effectively present on every unmodified Windows 10 and Windows 11 installation.

The ubiquity of Microsoft Defender makes it an attractive target for adversaries. A vulnerability that impairs Defender’s scanning capability can neutralize a key layer of defense, allowing subsequent malware deployment to proceed undetected. This attack pattern — using a Defender vulnerability as a precondition for malware delivery — is well-documented in threat actor playbooks and represents a meaningful escalation of impact beyond what the CVSS score alone might suggest.

CVE-2026-45498 is a denial of service vulnerability in the Microsoft Defender scanning engine triggered by malformed file content. When Defender processes a specially crafted file during a scan (either on-access or on-demand), it encounters an unhandled condition — likely a divide-by-zero, null pointer dereference, or infinite loop in a format parser — that causes the scanning engine process to crash or hang. The result is that Defender stops providing real-time protection until the service is restarted, either manually or by Windows’ service recovery mechanisms.

While classified as medium severity with a CVSS of 6.5, the operational impact of disabling endpoint protection should not be underestimated, particularly in environments where Defender is the sole or primary defense layer. CISA added the vulnerability to the KEV catalog on May 20, 2026, confirming exploitation in real-world attack chains.

Technical Mechanism

Microsoft Defender’s scanning engine (MsMpEng.exe) parses hundreds of file formats to extract content for signature and behavioral analysis. The parsing logic for certain file types involves complex state machines and format-specific handling code, and vulnerabilities can arise when input files contain structures that deviate from expected format constraints in ways the parser does not gracefully handle.

CVE-2026-45498 is triggered when the Defender scanning engine processes a file crafted with malformed internal structures. The precise file format involved has not been fully disclosed, but the vulnerability class suggests a parsing flaw where:

• A length field in the file’s internal structure is set to an unexpected value (e.g., zero or a very large number), causing an arithmetic operation in the parser to produce an invalid result
• Or a structural pointer or offset resolves to an out-of-bounds memory region, triggering an access violation
• Or the parser enters a loop condition that does not terminate, consuming CPU resources until the process is killed by the watchdog or the system

Because Defender’s on-access scanning intercepts file operations transparently, an attacker can trigger this vulnerability simply by placing a crafted file in a location that Defender will scan — such as a download directory, email attachment staging area, or any path included in real-time protection scope. The attacker does not need to execute the file; merely presenting it to the file system on a monitored path is sufficient.

Attack flow:

1. Attacker crafts a malformed file that triggers the Defender parser flaw
2. Attacker delivers the file to a target system via email attachment, web download, network share, or USB media
3. Defender’s on-access scan component intercepts the file operation and passes the file to MsMpEng.exe for analysis
4. The parser encounters the malformed structure and crashes or hangs
5. Defender’s real-time protection goes offline (the service may auto-restart after a delay)
6. During the protection gap, attacker delivers actual malware payload that Defender would otherwise detect
7. Malware executes without Defender interference

In multi-stage attack scenarios, the DoS file and the subsequent malware payload may be delivered in rapid succession or bundled in a ZIP archive, exploiting the window between Defender’s crash and recovery.

# CVE-2026-45498 — Conceptual malformed file generator
# Crafts a file with a zero-length field to trigger arithmetic fault in Defender parser
import struct

def build_malformed_file(output_path):
    # Minimal header with a malformed length field (0x00000000 where parser expects >0)
    header = b'\x4D\x5A'            # magic bytes (PE-like signature)
    header += struct.pack('<I', 0)   # malformed SizeOfOptionalHeader = 0 (triggers divide-by-zero)
    header += b'\x00' * 0x3A        # padding to reach e_lfanew offset
    header += struct.pack('<I', 0x40) # e_lfanew points to PE header
    header += b'\x00' * 0x40        # filler

    with open(output_path, 'wb') as f:
        f.write(header)

build_malformed_file("/tmp/trigger.exe")
# Place trigger.exe in any Defender-monitored directory to fire on-access scan
# e.g. copy to C:\Users\Public\Downloads\ via email attachment or web download

# Verify Defender crashes after file drop (run from admin PowerShell to check service state)
Get-Service WinDefend | Select-Object Status, StartType
# Expected after exploit: Status=Stopped or Status=StartPending (auto-recovery in progress)

Real-World Exploitation Evidence

CISA’s KEV addition confirms that CVE-2026-45498 has been exploited in real attacks, not merely demonstrated as a proof of concept. Exploitation has been observed in the context of multi-stage malware delivery chains where the Defender DoS is used as a precursor step to disable protection before deploying a second-stage payload.

This exploitation pattern mirrors documented use of earlier Defender vulnerabilities. Threat actors distributing commodity malware — particularly ransomware precursors and information stealers — have incorporated Defender-disabling techniques into their delivery mechanisms, and a file-based DoS trigger is an attractive option because it requires no privilege escalation or administrative access: any user-level file write can trigger on-access scanning.

Security researchers have noted that the CVSS score of 6.5 understates the chained impact when the DoS is used as a defense evasion component in a broader attack rather than as a standalone disruptive action.

Impact Assessment

• Endpoint protection disabled — When MsMpEng.exe crashes, real-time protection is suspended, leaving the endpoint unprotected against malware until the service recovers. Recovery may take minutes, creating a reliable exploitation window.
• Defense evasion enablement — The primary exploitation value is as a precursor: neutralizing Defender before delivering a second-stage payload that Defender signatures would otherwise detect.
• Repeated triggering — An attacker who can repeatedly deliver the crafted file can keep Defender in a persistent crashed/restarting cycle, effectively maintaining a long-term protection gap.
• Operational disruption — In environments relying on Defender for endpoint compliance posture, repeated crashes may trigger compliance alerts and security team investigations, consuming incident response resources.
• Limited direct damage — Unlike RCE vulnerabilities, this flaw does not directly grant the attacker code execution or data access. Its impact is primarily defensive degradation.
• Broad exposure — The vulnerability affects any Windows system with Defender active, representing an enormous potential attack surface given Windows’ market share.

Affected Versions

Remediation Steps

1. Ensure Windows Update is current — Microsoft Defender’s engine updates are delivered via Windows Update and Microsoft Update. Verify that automatic updates are enabled and that the latest engine version has been applied.

# Check current Defender engine version
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, AntivirusSignatureLastUpdated

# Force immediate signature and engine update
Update-MpSignature

# For enterprise: trigger update via Intune or WSUS, or use the SCCM client action
# WSUS — initiate software update scan cycle on managed endpoints
wuauclt /detectnow /updatenow

# Verify engine version post-update (confirm at or above version in Microsoft advisory)
Get-MpComputerStatus | Select-Object AMEngineVersion

2. Check engine version — In Windows Security Center, navigate to Virus & threat protection > Virus & threat protection updates to confirm the engine version is at or above the patched level specified in Microsoft’s advisory.
3. For enterprise deployments — Use Microsoft Endpoint Configuration Manager, Microsoft Intune, or Windows Server Update Services (WSUS) to push the engine update to all managed endpoints promptly.
4. Layer defenses — Do not rely solely on Defender. Deploy supplementary endpoint detection and response (EDR) tools that operate independently of the antivirus engine, ensuring coverage persists if the AV component is disrupted.
5. Monitor for service crashes — Configure monitoring for unexpected MsMpEng.exe crashes or Windows Defender service restarts. Repeated or correlated crashes across multiple endpoints may indicate active exploitation.
6. Review email and web gateway scanning — Ensure that crafted files can be pre-screened at the gateway level (email security, web proxy with content inspection) before reaching endpoints, reducing the chance that a triggering file reaches Defender.

Detection Guidance

Detection focuses on identifying the Defender DoS event and correlating it with subsequent suspicious activity:

• Windows Event Log: look for event ID 3002 (Microsoft Defender Antivirus real-time protection encountered an error) or service crash events in the System log (Source: Service Control Manager, Event ID 7034 for unexpected service termination of WinDefend)
• EDR telemetry: MsMpEng.exe process crashes with exit codes indicating access violation (0xC0000005) or abnormal termination
• Correlate Defender service restart events with file creation events immediately preceding the crash, particularly for files in download directories, temp paths, or email attachment staging locations
• Unusual files appearing in monitored directories shortly before a Defender service disruption event
• Anti-malware scan interface (AMSI) telemetry gaps or coverage lapses that coincide with a Defender engine restart

# Splunk SIEM query — detect Defender engine crash events and correlate with preceding file drops
index=wineventlog source="WinEventLog:System"
  ((EventCode=7034 AND Message="*WinDefend*") OR (EventCode=7036 AND Message="*Windows Defender*stopped*"))
| eval crash_time=_time
| join type=left host [
    search index=wineventlog source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    | where _time > relative_time(now(), "-5m")
    | rename _time as file_create_time, TargetFilename as suspicious_file
  ]
| where file_create_time < crash_time AND file_create_time > crash_time - 60
| table host, crash_time, file_create_time, suspicious_file
| sort -crash_time

# Suricata signature — detect delivery of files to trigger Defender DoS (network-side)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-45498 Microsoft Defender DoS Trigger File Download"; flow:established,from_server; file_data; content:"\x4D\x5A"; within:2; byte_test:4,=,0,0x3C,little; sid:9026454; rev:1;)
alert smtp any any -> $HOME_NET any (msg:"CVE-2026-45498 Defender DoS Trigger File via Email Attachment"; flow:established; content:"Content-Disposition: attachment"; content:".exe"; distance:0; within:64; sid:9026455; rev:1;)

Timeline

References

• NVD — CVE-2026-45498
• CISA KEV — CVE-2026-45498
• Microsoft MSRC — CVE-2026-45498