ShieldCrash PoC: Microsoft Defender Fix Bypass
Microsoft fixed a flaw in its Defender antivirus engine, but a new proof-of-concept shows attackers can still read files on your Windows PC with full system access. This does not let them install malware or delete files, but it could help them steal data or spy on you.
- Report priority
- High
- Targets
- Microsoft
How it works
- Microsoft fixed a flaw in its Defender antivirus engine that let attackers run code with full system access.
- A new proof-of-concept shows attackers can still trick Defender into reading any file on your Windows PC, even after Microsoft's fix.
- The attacker sends a specially crafted file to Defender, which then reads that file and any other file the attacker picks.
- This does not let the attacker write new files or run their own code, but it could help them steal data or spy on you.
What to do
Check if you have the latest version of Windows installed. Open Settings, then go to System > About. If your version is earlier than the one Microsoft released after the ShieldBreak fix, you are affected. Microsoft has not yet confirmed if this bypass is fixed in the latest version, so check for updates now.
Update your Windows PC to the latest version immediately. If you cannot update, disable Microsoft Defender temporarily until you can. Microsoft has not yet provided a specific fix for this bypass, so wait for their official guidance.
Technical details
An attacker sends a malicious file to Defender, which then reads that file and any other file the hacker picks. This does not let the attacker write new files or run their own code, but it could help them steal data or spy on you.
A newly disclosed bypass, dubbed ShieldCrash, exploits residual weaknesses in Microsoft's fix for CVE-2026-69414 (ShieldBreak), a high-severity privilege escalation flaw in the Microsoft Malware Protection Engine (CVSS 7.8). Researchers claim the exploit allows arbitrary file reads with SYSTEM privileges on patched Windows systems, bypassing Microsoft's official remediation. Unlike the original CVE, ShieldCrash does not enable arbitrary writes or full SYSTEM code execution but requires an attacker with existing low-privilege execution on the target.
The vulnerability affects all supported Windows versions, including Windows 10, Windows 11, and Windows Server, though Microsoft has not confirmed the scope or released a separate patch. ShieldCrash is not a standalone CVE but a proof-of-concept demonstrating the bypass, published by Nightmare Eclipse. The attack vector remains local, requiring prior code execution or foothold.