Microsoft Patches Critical Flaw in Malware Protection Engine

The emergency update addressed CVE-2018-0986, which would let an attacker execute malicious code on a Windows machine.

Microsoft has issued an emergency patch for CVE-2018-0986, a remote code execution vulnerability in the Microsoft Malware Protection Engine (MMPE). Security researcher Thomas Dullien, with Googles Project Zero, is credited with finding the bug, Microsoft reports.
MMPE, or mpengine.dll, provides scanning, detection, and cleaning capabilities for Microsofts antivirus and antispyware software. Microsoft typically issues MMPE updates once a month, or as needed, to protect against new threats.
This critical vulnerability exists when MMPE doesnt properly scan a specially crafted file, which leads to memory corruption. If successfully exploited, this could let an attacker execute malicious code on a target machine; take control of the system and install programs; view, change, or delete data; or create new accounts with full user rights.
An affected version of MMPE needs to scan a specially crafted file in order for the bug to be exploited. There are a few ways an attacker could make this happen, Microsoft explains in a
security advisory
, and he or she doesnt need to be technically advanced to do it.
One way is to conceal the files on a website the victim visits. Another is to send the file via email or instant messenger. Alternatively, an attacker could abuse a website that hosts user-provided content by uploading the specially crafted file to a shared location.
MMPE will automatically scan files if the users anti-malware software has real-time protection enabled, so the vulnerability can be exploited without the user doing anything. If real-time scanning is not enabled, an attacker would have to wait for a scheduled scan in order to exploit.
All systems running an affected version of antimalware software are primarily at risk, Microsoft says. This update fixes the bug in MMPE version 1.1.14700.5 by adjusting how MMPE scans specially crafted files. In addition to the changes for this particular flaw, the patch also includes defense-in-depth updates to help improve security-related features, Microsoft says.
Administrators and users dont need to take action to install MMPE updates because theyre automatically applied within 48 hours of the patchs release. The exact time of deployment will depend on your software, Internet connection, and infrastructure configuration.
Related Content:
Active Cyber Defense Is an Opportunity, Not a Threat
New Attack Vector Shows Dangers of S3 Sleep Mode
Microsoft Rushes Out Fix for Major Hole Caused by Previous Meltdown Patch
7 Deadly Security Sins of Web Applications
Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda
here
. Register with Promo Code DR200 and save $200.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Patches Critical Flaw in Malware Protection Engine