Multiple vulnerabilities in Microsoft Defender and the Microsoft Malware Protection Engine allow for denial of service and elevation of privilege. CVE-2026-45498 (CVSS 4.0) affects Microsoft Defender Antimalware Platform versions from 4.18.26030.3011 up to, but not including, 4.18.26040.7, while CVE-2026-41091 (CVSS 7.8) affects Microsoft Malware Protection Engine versions from 1.1.26030.3008 up to, but not including, 1.1.26040.8. The fixed versions are 4.18.26040.7 and 1.1.26040.8, respectively, which should be applied immediately, noting that CVE-2026-45498 is being exploited in the wild.
Multiple vulnerabilities were identified in Microsoft Defender. Attacker could exploit some of these vulnerabilities to trigger denial of service condition and elevation of privilege on the targeted system. Note: CVE-2026-45498 is being exploited in the wild. Microsoft Defender contains an unspecified... Impact Denial of Service Elevation of Privilege System / Technologies affected Microsoft Malware Protection Engine Solutions Before installation of the software, please visit the software vendor web-site for more details. Apply fixes issued by the vendor: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498