CVE-2017-8540
Published: March 3, 2022
Official Description
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
CISA KEV Advisory
Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Apply updates per vendor instructions.
Risk Analysis
This vulnerability in the Microsoft Malware Protection Engine can lead to memory corruption when processing a specially crafted file, potentially resulting in remote code execution. With an EPSS score of 0.84613, there is a very high likelihood of exploitation, and its inclusion in CISA's KEV catalog confirms active exploitation. This is an urgent risk for systems running affected Microsoft security products.
This vulnerability is actively being exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. It is remotely exploitable by providing a specially crafted file that the engine attempts to scan.
Ensure that the Microsoft Malware Protection Engine and associated Microsoft security products (Forefront, Defender, Exchange Server) are updated to the latest versions. Regularly apply all available security updates for Windows operating systems.
Technical Analysis
CVE-2017-8540 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2017-8540 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2017-8540 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1