# CVE-2026-55011: Microsoft Defender integer underflow in Malware Protection Engine

Source: https://junglewise.ai/threats/cve-2026-55011-microsoft-defender-integer-underflow-in-malware-protection-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-55011 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in Microsoft Defender, the built-in antivirus and security software for Windows. An attacker who already has limited access to a computer could exploit this flaw to run malicious code with elevated permissions. This could lead to a full system takeover, allowing the attacker to steal data, install ransomware, or disrupt business operations.

Technologies: [Microsoft Malware Protection Engine](https://junglewise.ai/threats/technologies/malware-protection-engine). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-55011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55011 being exploited in the wild.

**How severe is CVE-2026-55011?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Microsoft Malware Protection Engine 1.1.0.0 to 1.1.26060.3008.

**Is there a fix for CVE-2026-55011?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55011 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-55011?** Check whether you run Microsoft Malware Protection Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow (CWE-191) exists in the Microsoft Malware Protection Engine (Microsoft Defender). The vulnerability is triggered when the engine processes specially crafted files, leading to a memory corruption condition. While the attack vector is classified as local, it requires user interaction (UI:R), such as a user downloading or opening a malicious file that Defender then scans. Successful exploitation allows an unauthorized attacker to execute arbitrary code in the security context of the LocalSystem account, effectively gaining full control over the host. Microsoft has released updates to address this issue in version 1.1.26060.3008 and later.

## Affected products

- Microsoft Malware Protection Engine 1.1.0.0 to 1.1.26060.3008

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011)

## Related threats

- [Microsoft Defender Malware Protection Engine elevation of privilege](https://junglewise.ai/threats/cve-2026-69414-microsoft-defender-malware-protection-engine-elevation-of)
- [Microsoft Malware Protection Engine integer overflow code execution](https://junglewise.ai/threats/cve-2026-55012-microsoft-malware-protection-engine-integer-overflow-code)
- [Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability](https://junglewise.ai/threats/cve-2017-8540-microsoft-malware-protection-engine-improper-restriction-of)