CVE-2017-8540
HIGH KEVMicrosoft Malware Protection Engine 1.1.13701.0-1.1.13704.0 - Remote Code Execution via Crafted File Scan
Title source: llmExploitation Summary
CVE-2017-8540 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022. EIP tracks 1 public exploit from researchers including Google Security Research.
AI-analyzed exploit summary This exploit leverages a garbage collection vulnerability in Microsoft Malware Protection Engine (MsMpEng) by triggering a GC during a callback where it should be disabled. The PoC uses a crafted JavaScript object with overridden toString and valueOf methods to force a GC via eval, leading to a use-after-free condition.
Description
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
Exploits (1)
This exploit leverages a garbage collection vulnerability in Microsoft Malware Protection Engine (MsMpEng) by triggering a GC during a callback where it should be disabled. The PoC uses a crafted JavaScript object with overridden toString and valueOf methods to force a GC via eval, leading to a use-after-free condition.
References (5)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H