# CVE-2026-55012: Microsoft Malware Protection Engine integer overflow code execution

Source: https://junglewise.ai/threats/cve-2026-55012-microsoft-malware-protection-engine-integer-overflow-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-55012 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in Microsoft Defender, the built-in antivirus and security software for Windows. An attacker could exploit this flaw to run unauthorized code on a target system, potentially leading to a full system takeover. While the attack requires a user to perform an action, such as opening a malicious file, it poses a significant risk to data confidentiality and system integrity.

Technologies: [Microsoft Malware Protection Engine](https://junglewise.ai/threats/technologies/malware-protection-engine). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-55012 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55012 being exploited in the wild.

**How severe is CVE-2026-55012?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Microsoft Malware Protection Engine 1.1.0.0 to 1.1.26060.3008.

**Is there a fix for CVE-2026-55012?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55012 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-55012?** Check whether you run Microsoft Malware Protection Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow or wraparound vulnerability (CWE-190) exists in the Microsoft Malware Protection Engine, which can lead to a heap-based buffer overflow (CWE-122). The vulnerability is triggered when the engine parses a specially crafted file. An attacker who successfully exploits this could execute arbitrary code in the security context of the LocalSystem account. The attack vector is local, requiring a user to open or interact with a malicious file (User Interaction: Required). The issue affects versions 1.1.0.0 through 1.1.26060.3008 and is addressed in subsequent updates.

## Affected products

- Microsoft Malware Protection Engine 1.1.0.0 to 1.1.26060.3008

## Timeline

- 2026-07-14: advisory: Initial publication by Microsoft and NVD.

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012)

## Related threats

- [Microsoft Defender Malware Protection Engine elevation of privilege](https://junglewise.ai/threats/cve-2026-69414-microsoft-defender-malware-protection-engine-elevation-of)
- [Microsoft Defender integer underflow in Malware Protection Engine](https://junglewise.ai/threats/cve-2026-55011-microsoft-defender-integer-underflow-in-malware-protection-engine)
- [Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability](https://junglewise.ai/threats/cve-2017-8540-microsoft-malware-protection-engine-improper-restriction-of)