High severity · published Dec 7, 2017
CVE-2017-11937
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703,…
7.8
CVSS
28.3%
EPSS
No
On KEV
Description
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)28.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Malware Protection Engine · Microsoft
through 1.1.14306.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-11937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-11937
Third Party Advisory
http://www.securityfocus.com/bid/102070
Third Party Advisory
http://www.securitytracker.com/id/1039972
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937
More from Malware Protection Engine
7.8
CVE-2026-41091
Microsoft Defender Elevation of Privilege Vulnerability
7.8
CVE-2017-8540
Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
8.1
CVE-2026-45584
Microsoft Defender Remote Code Execution Vulnerability
7.8
CVE-2026-69414
Microsoft Defender Elevation of Privilege Vulnerability
7.8
CVE-2026-55012
Microsoft Defender Remote Code Execution Vulnerability