Microsoft has posted an out-of-band security update to fix a remote code execution flaw in its Malware Protection Engine.

The flaw, CVE-2017-11937, has not yet been exploited yet but it is a real doozy.

The security hole is present in Windows Defender and Microsoft Security Essentials, as well as Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016.

It was discovered and reported by the UK's National Cyber Security Centre – which is part of GCHQ, Blighty's spying nerve centre.

The vulnerability can be triggered when the Malware Protection Engine scans a downloaded file to check for threats. In many systems this is set to happen automatically for all new files.

By exploiting a memory corruption error in the malware scanning tool, the attack file can execute code on the target machine with LocalSystem privileges.

Microsoft said: "There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user.

"An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server."

Microsoft notes that, because Malware Protection Engine is set up to constantly receive updates, the fix will automatically be delivered over the air for most home users and many enterprise customers.