Microsoft Defender: Remote code execution via null pointer dereference
Summary
A null pointer dereference in the Microsoft Malware Protection Engine, which powers Microsoft Defender, allows an unauthenticated attacker to execute code over a network. According to the CVE record, user interaction is required, for example when the scanning engine processes attacker-supplied content. The engine is present on most Windows endpoints, so SMEs with unmanaged or offline systems are most at risk. Microsoft's own severity rating is not yet confirmed; the CVE record gives CVSS 8.8.
Affected
- Microsoft Malware Protection Engine from 1.1.0.0 before 1.1.26100.4
- Used by Microsoft Defender and System Center Endpoint Protection
Fixed in
- Malware Protection Engine 1.1.26100.4 or newer
- Release date not confirmed; verify on the MSRC advisory
Workaround
- Unknown. No workaround identified; updating the engine is the remedy.
Exploitation
- In the wild: no evidence found; not confirmed in CISA KEV (not verified directly).
- Public proof of concept: unknown.
- CVSS vector includes E:U (exploit maturity unproven).
Our recommendation
- Check the engine version on all Windows endpoints, including servers and offline systems, for example with Get-MpComputerStatus. Target 1.1.26100.4 or newer.
- Force an engine update where versions are older, and make sure WSUS, Intune or firewall rules do not block Defender updates.
- Review the MSRC advisory for the official severity rating and any additional guidance.
- Re-check NVD and CISA KEV in a few days.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-122194 msrc.microsoft.com
- CVE Record CVE-2026-122194 www.cve.org
- Microsoft Defender Updates (Security Intelligence) www.microsoft.com
- Microsoft Defender Endpoint releases learn.microsoft.com
- CSO Online: Microsoft patches two zero-day flaws in Defender www.csoonline.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
- Strix: CVE-2026-122194 www.strix.ai
- CISA alert: RCE vulnerability affecting Microsoft Defender (2021) www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:18.
Original description (NVD)
Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.