CVE-2017-11937 in the critical feed json
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1…
published 2017-12-07 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3523
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 28.3%
- EPSS 28.3% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Patch / fix
Exploit prediction
28.33% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Corporation Microsoft Malware Protection Engine
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2017-11937
patch, vendor-advisory
-
securitytracker.com
/id/1039972
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/102070
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-11937
- NVD CVE-2017-11937
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.