CVE-2021-1647

CVE-2021-1647 is a remote code execution flaw in Microsoft Defender's antimalware engine, categorized by CISA as a heap-based buffer overflow (CWE-122) arising from improper validation of crafted input values (CWE-1285). It is triggered when the Defender engine processes maliciously crafted content, for example a crafted file delivered via email or the web that Defender scans, causing the overflow during processing. Successful exploitation lets an attacker run arbitrary code on the target machine in the context of the Defender process, potentially leading to full system compromise. Any system running the affected Defender engine is exposed, including Windows 10 and Windows Server deployments where Defender is the default or widely deployed antivirus; the source data provides no fixed version numbers, only the vendor-issued update. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of 2021-11-03, indicating exploitation has been observed in the wild, though no public PoC is known and ransomware use is listed as unknown.

What to do: Apply Microsoft's Defender antimalware engine/platform updates per vendor instructions and ensure Defender security intelligence and platform updates are enabled everywhere, including infrequently updated servers and endpoints. After updating, verify the Defender engine version on high-value hosts is current, prioritizing systems listed in CISA KEV remediation requirements.