Microsoft Malware Protection Engine RarVM Remote Code Execution Vulnerability

Strike ID:
E18-0jqy1
CVSS:
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
False Positive:
f
Variants:
1
Year:
2018

Description

This strike exploits a remote code execution vulnerability in Microsoft Malware Protection Engine. The vulnerability is due to how the engine handles specially crafted RAR files during scanning. By exploiting this vulnerability, an attacker could execute arbitrary code in the security context of the LocalSystem account and take control of the system.

CVE

References

Bid