microsoft malware protection engine

Name: microsoft malware protection engine
Brand: microsoft

productUS

cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

critical

by severity

0critical14high8medium1low

updated 2026-10-28

vulnerabilities (31)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-8540US	high7.8OT critical	71.9% (99th)	KEV	1.1.13704.0	2017-05-26	1.1.13701.0 → 1.1.13704.0
CVE-2026-41091US	—OT critical	8.20% (95th)	KEV	1.1.26040.8	2026-05-20	1.1.26030.3008 → 1.1.26040.8
CVE-2017-0290US	high7.8	81.4% (100th)	Exploit	no fix	2017-05-09	≤ 1.1.13701.0
CVE-2017-8538US	high7.8	50.0% (99th)	Exploit	no fix	2017-05-26	≤ 1.1.13704.0
CVE-2017-8541US	high7.8	48.1% (99th)	Exploit	no fix	2017-05-26	≤ 1.1.13704.0
CVE-2026-50656US	high7.0	11.2% (96th)	Exploit	no fix	2026-06-16	—
CVE-2026-69414US	—	1.32% (71st)	Exploit	no fix	2026-08-14	—
CVE-2026-45584US	—	0.85% (58th)	Exploit	1.1.26040.8	2026-05-20	1.1.26030.3008 → 1.1.26040.8
CVE-2006-5270US	high9.3	30.3% (98th)	—	no fix	2007-02-13	—
CVE-2017-11937US	high7.8	28.3% (98th)	—	no fix	2017-12-07	≤ 1.1.14306.0
CVE-2017-11940US	high7.8	20.5% (97th)	—	no fix	2017-12-08	≤ 1.1.14306.0
CVE-2014-2779US	medium4.3	13.4% (96th)	—	no fix	2014-06-18	≤ 1.1.10600.0
CVE-2008-1437US	medium5.0	12.9% (96th)	—	no fix	2008-05-13	2 versions
CVE-2008-1438US	medium5.0	12.9% (96th)	—	no fix	2008-05-13	2 versions
CVE-2013-1346US	high9.3	11.6% (96th)	—	no fix	2013-05-15	≤ 1.1.9402.0
CVE-2021-31985US	medium6.8	7.76% (95th)	—	1.1.18200.3	2021-06-08	< 1.1.18200.3
CVE-2017-8542US	medium5.5	6.02% (93rd)	—	no fix	2017-05-26	≤ 1.1.13704.0
CVE-2017-8539US	medium5.5	6.02% (93rd)	—	no fix	2017-05-26	≤ 1.1.13704.0
CVE-2021-42298US	high9.3	5.85% (93rd)	—	1.1.18700.3	2021-11-10	< 1.1.18700.3
CVE-2023-24860US	—	3.07% (88th)	—	1.1.20200.4	2023-04-11	< 1.1.20200.4
CVE-2022-24548US	medium4.3	3.01% (87th)	—	1.1.19100.5	2022-04-15	< 1.1.19100.5
CVE-2021-34522US	high9.3	2.72% (86th)	—	1.1.18242.0	2021-07-14	< 1.1.18242.0
CVE-2021-34464US	high9.3	2.64% (86th)	—	no fix	2021-07-16	—
CVE-2011-0037US	high7.2	1.78% (78th)	—	no fix	2011-02-25	3 versions
CVE-2021-31978US	low2.1	1.23% (69th)	—	1.1.18200.3	2021-06-08	< 1.1.18200.3
CVE-2022-37971US	—	0.70% (53rd)	—	1.1.19700.2	2022-10-11	< 1.1.19700.2
CVE-2021-34471US	medium4.6	0.51% (43rd)	—	1.1.18400.4	2021-08-12	< 1.1.18400.4
CVE-2026-55012US	—	0.47% (40th)	—	1.1.26060.3008	2026-07-14	< 1.1.26060.3008
CVE-2026-55011US	—	0.47% (40th)	—	1.1.26060.3008	2026-07-14	< 1.1.26060.3008
CVE-2023-33156US	high7.0	0.27% (20th)	—	1.1.23050.3	2023-07-11	< 1.1.23050.3
CVE-2023-23389US	—	0.26% (17th)	—	no fix	2023-03-14	= 1.1.20000.2

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer9 CVEs
CWE-20Improper Input Validation5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')3 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')3 CVEs
CWE-122Heap-based Buffer Overflow2 CVEs
CWE-190Integer Overflow or Wraparound2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE31 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan