CVE-2017-8540

Published: May 26, 2017Modified: Apr 22, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.

Affected (11)

Products: Microsoft: Malware Protection Engine, Endpoint Protection, Exchange Server, Forefront Endpoint Protection, Forefront Security, Intune Endpoint Protection, Security Essentials, System Center Endpoint Protection, Windows Defender

Microsoft

9 products

Malware Protection Engine

Endpoint Protection

Exchange Server

Forefront Endpoint Protection

Forefront Security

Intune Endpoint Protection

Security Essentials

System Center Endpoint Protection

Windows Defender

Configuration A

1 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Microsoft Malware Protection Engine	From 1.1.13701.0 to 1.1.13704.0

Running on/with	Platform Versions
Microsoft Windows 10 1507	All versions
Microsoft Windows 10 1511	All versions
Microsoft Windows 10 1607	All versions
Microsoft Windows 10 1703	All versions
Microsoft Windows 7	All versions
Microsoft Windows 8.1	All versions
Microsoft Windows Rt 8.1	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2 sp1
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Microsoft Endpoint Protection	All versions
Microsoft Exchange Server	Version 2013
Microsoft Exchange Server	Version 2016
Microsoft Forefront Endpoint Protection	All versions
Microsoft Forefront Endpoint Protection	Version 2010
Microsoft Forefront Security	All versions
Microsoft Intune Endpoint Protection	All versions
Microsoft Security Essentials	All versions
Microsoft System Center Endpoint Protection	All versions
Microsoft Windows Defender	All versions