CVE-2017-8540VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2017-8540: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability

Affects Microsoft Malware Protection EngineSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/24/2022
EPSS: 71.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-8540 (opens in a new tab)

Description

CVE-2017-8540 is a high-severity vulnerability in the Microsoft Malware Protection Engine used by various Microsoft security products on multiple Windows versions and Microsoft Exchange Server. The flaw involves improper scanning of specially crafted files, which can cause memory corruption and potentially allow remote code execution. This vulnerability has been exploited in the wild.

Summary

The Microsoft Malware Protection Engine, which runs on Microsoft Forefront, Microsoft Defender, and Microsoft Exchange Server across multiple Windows platforms, improperly handles specially crafted files. This improper restriction of operations leads to memory corruption, enabling remote code execution. The vulnerability affects Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, as well as Microsoft Exchange Server 2013 and 2016. It is tracked as CWE-119 and has been exploited in the wild.

Impact

Successful exploitation can lead to remote code execution on affected systems, allowing attackers to execute arbitrary code with the privileges of the Malware Protection Engine. This can compromise system integrity and potentially lead to full system compromise.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this vulnerability has been exploited in the wild, it is recommended to monitor official Microsoft security advisories for updates and apply any available patches promptly once released.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:40:33 UTC

Weaknesses

References

Related threats