PT-2021-1546 · Microsoft+1 · Defender+2
Published
2021-01-12
·
Updated
2026-03-10
·
CVE-2021-1647
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Defender versions prior to the fixed version
Description
The issue is related to insufficient input validation in the mpengine.dll library of Microsoft Defender, allowing a remote attacker to execute arbitrary code using a specially crafted file. The vulnerability is actively being exploited. It has been reported that North Korean hackers created a fake blog and social media accounts to target infosec researchers, offering them a joint project that included a malicious library. The hackers also posted fake videos and exploited 0-day vulnerabilities in Chrome and Windows 10 on their blog to infect visiting experts.
Recommendations
For Microsoft Defender versions prior to the fixed version, update to the latest version to resolve the issue.
As a temporary workaround, consider restricting access to the mpengine.dll library until a patch is available.
Avoid using potentially vulnerable features in Microsoft Defender until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability, however, it is recommended to check the official Microsoft website for the latest updates and patches.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Google Chrome
Defender
Windows 10