CVE-2026-105726: Defender out-of-bounds read leaks heap memory to local users

What it is

An out-of-bounds read (CWE-125) in Microsoft Defender. An authorized local attacker, meaning someone who already has a low-privileged account on the machine, can read parts of heap memory, per Microsoft’s FAQ. It is an information disclosure only. It does not give code execution or change anything on the system.

Microsoft rates it Important with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N). It marks exploitation as “Less Likely”, not exploited and not publicly disclosed. The CISA ADP entry lists exploitation as “none”.

The practical risk is as a helper step. Leaked heap memory can expose data from the Defender process, and attackers sometimes use such leaks to defeat memory protections in a later exploit. Microsoft does not say that has happened here.

Am I affected?

You are affected if Microsoft Defender runs on a Windows endpoint with a version older than 4.18.26060.3008. The CVE record lists everything from 1.0.0.0 up to that build.

Microsoft’s advisory data does not list product-specific build tables beyond this range, and it states no required configuration. Treat every Windows host with active Defender as in scope.

The vulnerable version is shown in the Antimalware Client Version field. In Windows Security, open Virus & threat protection > Protection updates, then check the version information. Confirm the exact menu path in Microsoft’s documentation for your build.

Microsoft lists no workarounds.

What to do

1. Confirm the update landed. Defender components normally update automatically through Microsoft’s update channels. Check that endpoints report 4.18.26060.3008 or later.
2. Chase the stragglers. Machines with blocked update channels, golden images, offline systems and VDI templates lag. Verify the version from an independent source, not only from the console health status.
3. No workaround exists. Until a host is updated, the only mitigation is limiting who can log on locally, since the attacker needs a local account.
4. No hunt needed on current evidence. Nothing indicates exploitation. If you have other signs of a low-privileged intruder on a host, update it and handle that as a separate incident.

Detection

No exploitation has been reported and no indicators have been published, so there is nothing specific to hunt for.

• Use your inventory or EDR to list Windows hosts with an Antimalware Client Version below 4.18.26060.3008.
• Review local logons by unexpected low-privileged accounts on servers, since the flaw needs local access.
• Re-check this page if Microsoft changes the exploitation assessment. Revisit the advisory for updates.