Exploit for #VU87472 Security features bypass in Windows Defender antimalware platform

Vulnerability identifier: #VU87472

Vulnerability risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2024-20671

CWE-ID: CWE-254

Exploitation vector: Local

Exploits in database: 1

• June 27, 2025
  • EDR-ALPC-Block-POC (Blocking Windows EDR agents by registering an own IPC-object in the Object Manager’s namespace (CVE-2023-3280, CVE-2024-5909, CVE-2024-20671)) [Github]

Vulnerable software:
Windows Defender antimalware platform
Client/Desktop applications / Antivirus software/Personal firewalls

Vendor: Microsoft