Main Vulnerability Database Vulnerabilities #VU6801

Memory corruption in Microsoft products - CVE-2017-8540

Published: May 30, 2017 / Updated: March 8, 2022

Vulnerability identifier: #VU6801

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8540

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

Microsoft Security Essentials
Microsoft Endpoint Protection
Windows Intune Endpoint Protection
Windows Defender
Microsoft Malware Protection Engine
Microsoft Forefront Endpoint Protection
Microsoft Exchange Server

How to mitigate CVE-2017-8540

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Links to Public Exploits and PoC-codes

Exploit #1222 - Microsoft MsMpEng - Remotely Exploitable Use-After-Free due to Design Issue in GC Engine (March 18, 2020)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8540

Related Security Bulletins

Multiple vulnerabilities in Microsoft Malware Protection Engine