Microsoft Defender Heap Buffer Overflow Allows Remote Code Execution

The National Vulnerability Database has disclosed CVE-2026-45584, a high-severity heap-based buffer overflow affecting Microsoft Defender. This critical flaw allows an unauthenticated, unauthorized attacker to execute arbitrary code over a network without user interaction. The CVSS score for this vulnerability is 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

This is a serious issue. A network-based attack vector with no authentication or user interaction required means the attack surface is vast. While the attack complexity is rated ‘High’, this likely refers to the technical sophistication needed to craft the exploit, not the difficulty for a determined attacker. Given that Microsoft Defender is ubiquitous, the potential impact is widespread across virtually all Windows environments.

Defenders need to treat this as a top priority. A successful exploit could lead to full system compromise, enabling lateral movement and data exfiltration. The attacker’s calculus here is straightforward: Defender is installed everywhere, and a reliable exploit grants a foothold into countless organizations. Patching isn’t enough; organizations must also assume potential compromise and hunt for post-exploitation activity.