CVE-2017-11940 in the critical feed json
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1…
published 2017-12-08 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3526
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 20.5%
- EPSS 20.5% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". This is different than CVE-2017-11937.
Patch / fix
Exploit prediction
20.51% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Corporation Microsoft Malware Protection Engine
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2017-11940
patch, vendor-advisory
-
securitytracker.com
/id/1039972
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/102104
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-11940
- NVD CVE-2017-11940
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.