Windows 10: Microsoft has released a security update for the Malware Protection Engine after the discovery of a Remote Code Execution (RCE) flaw that could allow an attacker to take control of a vulnerable system.
Since the flaw exists in the Malware Protection Engine that powers the security products Windows Defender, Microsoft Exchange Server 2013 and 2016, and Microsoft Security Essentials, it automatically makes them vulnerable to exploits.
Microsoft explains that an attack on Windows 10 begins when an antivirus detects a modified file. The attacker must find a way to deliver the file to the target system. The most common tactics are via email or direct download from third-party websites.
The vulnerability is triggered when the antivirus scans for malware. As Microsoft warns in a statement, “If the vulnerable AntiMalware software has real-time protection enabled, the Microsoft Malware Protection Engine will automatically scan the files leading to exploitation of the vulnerability. If real-time scanning is not enabled, an attacker would have to wait until the scheduled scan is performed to exploit the vulnerability. In short, all systems running infected antimalware softwareare at risk.
The new patch fixes the way Microsoft's Malware Protection Engine scans modified files. So once the update is deployed, even if the infected file gets onto your system, it won't be able to harm it.
If you want more security, you can install the 1.1.14700.5 version of the Microsoft Malware Protection Engine by going to Windows Defender Security Center > Settings > About.
