MPENGINE FUZZER // MUTATION-BASED CVE RESEARCH

22DIV / george wu // CSEC research on own hardware // June 2026

OVERVIEW

A mutation-based fuzzer targeting mpengine.dll — the core scan engine inside Windows Defender. The fuzzer generates malformed PE files, scripts, and documents, submits them to the scan pipeline, and monitors for crashes, hangs, or anomalous behaviour. Built to find memory corruption vulnerabilities suitable for CVE submission via MSRC.

100,000 ITERATIONS 0 CRASHES (CURRENT CORPUS) MSRC DISCLOSURE TARGET OWN HARDWARE ONLY

ARCHITECTURE

ComponentFunction
Corpus generatorMutates PE headers, section tables, import tables, overlay data
Submission harnessTriggers Defender scan on each mutated sample via filesystem write
Crash monitorWER integration — captures MsMpEng crash dumps automatically
Reproduce engineMinimises crashing sample to smallest reproducible input

CAMPAIGN RESULTS

CAMPAIGN 1 — mpengine.dll PE mutation
100,000 iterations — 0 crashes

First corpus: malformed PE files with corrupted headers, invalid section counts, overlapping sections, import table corruption. MsMpEng handled all inputs without crashing. Result documented — PE parser appears robust against this mutation class.

NEXT TARGETS
Expanding corpus to script and document parsers

VBScript/JScript emulation, Office macro parsing, PDF stream handling, and ZIP/Cabinet decompression. These parser paths have historically yielded memory corruption vulnerabilities in AV engines.

RESEARCH RATIONALE

AV engine parsers run at high privilege and process untrusted input — a memory corruption bug in mpengine.dll could allow privilege escalation from standard user to SYSTEM via a malformed file. Finding such bugs through structured fuzzing and reporting them to MSRC is the highest-value contribution a solo researcher can make.

for cheyanne. always.