Microsoft Defender Update Crashes Virus Scans on Windows PCs

Microsoft Defender has been aborting Quick, Full, and Offline virus scans on Windows systems following a series of Security Intelligence updates released on August 18, 2026.

This issue has affected both consumer devices and Microsoft Defender for Endpoint-managed environments, disrupting a critical malware-detection capability for administrators and home users alike.

Microsoft Defender Update Crashes Virus Scans

Reports from Neowin, CyberInsider, Reddit, Microsoft Q&A, and Microsoft’s community forums indicate a consistent pattern of failures.

Quick and Full scans begin normally but soon terminate, displaying a Windows Security message that states the threat service has stopped and needs to be restarted. Unfortunately, restarting the service does not solve the issue, as subsequent scans fail in the same manner.

Offline scans appear to fail differently; users have reported that Microsoft Defender Offline scans stall at approximately 90%-93% completion and do not finish.

The current Microsoft Safety Scanner has also shown similar behavior, eliminating a common fallback option for users troubleshooting Defender problems.

However, not all scanning mechanisms seem to be affected. Several community testers reported that manually scanning an entire drive was successful, suggesting that the defect may be linked to Defender’s scheduled or standard scan workflows rather than every file inspection operation.

Event Viewer logs shared by users, including contributors in Microsoft Q&A and Reddit, point to crashes involving Defender’s antimalware service process, MsMpEng.exe.

According to CSN, the crash occurs in mpengine.dll and produces exception code 0xC0000005, indicating an access violation caused by invalid memory access.

Former ESET researcher and Neowin forum moderator Aryeh Goretsky linked the issue to Microsoft Malware Protection Engine versions 1.1.26070.7 and 1.1.26080.2 when used with several Security Intelligence updates, including versions 1.457.222.0 through 1.457.230.0. Later reports also mentioned version 1.457.235.0.

The timing of these issues has sparked speculation about a possible connection to ShieldBreak, a local privilege escalation proof of concept released shortly after Microsoft’s August 2026 Patch Tuesday.

ShieldBreak was described by its researcher, Nightmare Eclipse, as a bypass related to the earlier RoguePlanet vulnerability, tracked as CVE-2026-50656.

Some Reddit users suggested that Microsoft may have hurriedly deployed a signature or engine update intended to mitigate ShieldBreak, which inadvertently caused the scan failures.

Microsoft has not confirmed any link between the Defender scan crashes and the zero-day research, and the available evidence shows a correlation in timing rather than a direct cause.

Microsoft has reportedly said it is investigating the issue. However, no public incident bulletin has been issued as of this report. Community testing indicates that Security Intelligence Update 1.457.236.0 restored scan functionality on many machines.

In contrast, others required version 1.457.238.0 or later for Quick Scans to complete successfully.

Administrators should update Defender via Windows Update and verify remediation by running a completed Quick Scan, rather than relying solely on the reported version number.

Systems that remain unable to scan should use a trusted second-opinion antivirus tool and independently investigate suspicious files, as a Defender crash does not necessarily indicate the system is clean.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC