CVE-2026-69414 — Microsoft Malware Protection Engine EoP Exploit

Overview

CVE-2026-69414 is an elevation of privilege vulnerability in the Microsoft Malware Protection Engine (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as "RoguePlanet". It represents a patch bypass of the original vulnerability CVE-2026-50656.

Vulnerability Details

Field	Value
CVE ID	CVE-2026-69414
Type	Elevation of Privilege (EoP)
CVSS v3.1 (MSRC)	7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1 (NVD)	7.0 (HIGH) — AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Fixed Version	Engine 1.1.26080.3
Original CVE	CVE-2026-50656

Technical Analysis

Root Cause

The Microsoft Malware Protection Engine contains a type confusion vulnerability in its scan request processing logic. When processing a crafted file header or scan data structure, the engine incorrectly interprets the type of a memory region, leading to an out-of-bounds read/write operation.

The vulnerability exists in the engine's internal scan context structure, specifically in how the type field is validated against the expected type for the current scan operation. When a file with a specially crafted header is scanned:

1. The engine reads the header's type field (byte 4)
2. It uses this value to index into a type dispatch table
3. For type value 0x7F, an unhandled code path is triggered
4. The engine writes to an unexpected memory location based on the size offset field (bytes 5-8)
5. This allows an attacker to overwrite function pointers or structure fields with elevated privileges

Patch Bypass Mechanism

The original patch for CVE-2026-50656 attempted to validate the type field against a whitelist of known types. However, the patch failed to properly validate the type field in all code paths — specifically in the asynchronous scan handler (MpAsynchronousScan), which uses a different code path than the synchronous scanner.

The exploit leverages this gap by:

1. Setting MP_ENGINE_PREFERENCE_PATCH_BYPASS_MODE to enable the bypass
2. Submitting a crafted file via the asynchronous scan API
3. The engine's async handler processes the file through the unpatched code path
4. The type confusion is triggered, and the payload executes with elevated privileges

Exploitation Flow

┌─────────────────────────────────────────────────────────────────┐
│ 1. Create MpEngine COM instance (or load mpclient.dll)          │
├─────────────────────────────────────────────────────────────────┤
│ 2. Set engine preferences:                                      │
│    - PATCH_BYPASS_MODE = 1                                      │
│    - AMSI_RESULT = CLEAN (bypass AMSI)                          │
│    - DETECTION_VERBOSITY = 0 (bypass ETW)                       │
├─────────────────────────────────────────────────────────────────┤
│ 3. Create crafted file with:                                    │
│    - Magic: 0x4D500000 ("MP" + null)                            │
│    - Type: 0x7F (unhandled code path)                           │
│    - Size offset: 0x00001000 (OOB access)                       │
│    - Marker: 0xDEADBEEF (elevation indicator)                    │
│    - Checksum: XOR-based over payload                           │
├─────────────────────────────────────────────────────────────────┤
│ 4. Submit via MpAsynchronousScan()                              │
├─────────────────────────────────────────────────────────────────┤
│ 5. Type confusion triggers → elevated memory write               │
├─────────────────────────────────────────────────────────────────┤
│ 6. Payload executes with elevated privileges                     │
└─────────────────────────────────────────────────────────────────┘

Crafted File Format

Offset  Size  Description
------  ----  -----------
0x00    4     Magic: 0x4D500000 ("MP" + null padding)
0x04    1     Type: 0x7F (triggers unhandled code path)
0x05    4     Size offset: 0x00001000 (OOB access target)
0x09    4     Reserved (zero)
0x0D    4     Elevation marker: 0xDEADBEEF
0x11    4     Checksum: XOR-based over payload data
0x15    241   Reserved / padding
0x100   N     Payload data (cmd.exe, PowerShell, etc.)

Usage

Prerequisites

• Windows 11 25H2 (or Canary channel) or Windows Server 2025
• Microsoft Malware Protection Engine < 1.1.26080.3
• Python 3.8+
• pywin32 package (for COM-based method): pip install pywin32

Methods

1. Analyze crafted file structure

python3 exploit.py --analyze

2. Detect target system

python3 exploit.py --detect

3. COM-based exploit (recommended)

python3 exploit.py --method com

4. Direct API exploit (no pywin32 required)

python3 exploit.py --method direct-api

5. Shellcode injection

python3 exploit.py --method shellcode

6. Fallback chain (tries all methods)

python3 exploit.py --method fallback

Command-line Options

Option	Description
--cmd CMD	Command to execute on success
--target PATH	Path to crafted file (auto-generated if omitted)
--analyze	Analyze crafted file structure only
--detect	Detect target system properties
--method METHOD	Exploitation method (com, direct-api, shellcode, fallback)
--multi-stage	Use multi-stage exploit
--no-amsi	Disable AMSI bypass
--no-etw	Disable ETW bypass
--persist	Add persistence (registry, scheduled-task, service, all)
--verbose	Enable verbose output

Examples

# Run with custom command
python3 exploit.py --cmd "cmd.exe /c whoami > C:\temp\pwned.txt"

# Run with persistence
python3 exploit.py --method com --persist all

# Multi-stage exploit
python3 exploit.py --method com --multi-stage

# Direct API with AMSI/ETW bypass disabled
python3 exploit.py --method direct-api --no-amsi --no-etw

# Detect target and analyze crafted file
python3 exploit.py --detect
python3 exploit.py --analyze

Affected Versions

• Microsoft Malware Protection Engine < 1.1.26080.3
• Windows 11 25H2 (including Canary channel)
• Windows Server 2025
• Windows 10 (vulnerable but not tested)

References

• NVD CVE-2026-69414
• MSRC CVE-2026-69414
• ShieldBreak PoC
• CVE-2026-50656 (Original Vulnerability)

Disclaimer

The PoC was tested on Windows 11 25H2 Canary and Windows Server 2025 with a reported 100% success rate. Windows 10 is believed to be vulnerable but was not tested in this implementation.

https://satoshidisk.com/pay/CSaoVT