This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Microsoft Defender fixes 3 vulnerabilities

Microsoft has released updates for Microsoft Defender that fix a total of 3 vulnerabilities [1][2][3]. According to CISA, two of them (CVE-2026-41091 and CVE-2026-45498) are already being actively exploited [4].

Microsoft Defender - RCE (CVE-2026-45584)
CVSS 8.1 (High)

An unauthenticated remote attacker can execute arbitrary code due to a buffer overflow in Microsoft Defender [1].

The vulnerability is present in product:

  • Microsoft Malware Protection Engine; <1.1.26040.8

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 19. 6. 2026.

Microsoft Defender - privilege escalation (CVE-2026-41091)
CVSS 7.8 (High)

An authenticated local attacker can escalate their privileges due to improper link resolution before file access in Microsoft Defender [2]

The vulnerability is present in product:

  • Microsoft Malware Protection Engine; <1.1.26040.8

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

Microsoft Defender - DoS (CVE-2026-45498)
CVSS 4.0 (Medium)

An unauthenticated remote attacker can carry out a DoS attack in Microsoft Defender [3].

The vulnerability is present in product:

  • Microsoft Defender Antimalware Platform; <4.18.26040.7

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 1. 6. 2026.

CESNET, z.s.p.o. Logo