Windows Defender Scan Crashing? How to Fix the August 2026 Bug

Starting August 18, 2026, Windows Defender began crashing during Quick, Full, and Offline scans on machines running otherwise-current Windows 10 and 11 installations. Instead of finishing, a scan aborts partway through and Windows Security shows “Threat service has stopped. Restart it now” — and restarting the service doesn’t fix the next scan either. If this is happening to you, the short version is: it’s very likely a bad Defender update, not malware on your PC, and there’s a known fix.

What’s Actually Happening

Reports collected from Microsoft’s own support forums, Reddit’s r/sysadmin and r/antivirus communities, and security researchers point to the same failure pattern: Defender’s antimalware process, MsMpEng.exe, crashes inside a component called mpengine.dll with an access-violation error (exception code 0xC0000005). Quick and Full scans fail within seconds or stop unexpectedly partway through, while Offline scans — and even the standalone Microsoft Safety Scanner — tend to stall around 90–93% and never finish.

Security researcher Aryeh Goretsky traced the pattern to Malware Protection Engine versions 1.1.26070.7 and 1.1.26080.2 running with Security Intelligence updates in the 1.457.222.0 to 1.457.235.0 range. Critically, the same crash has shown up on freshly reinstalled, clean copies of Windows immediately after Defender updates were applied — which is strong evidence this is a bad update, not an infection interfering with your antivirus.

Is This Related to the ShieldBreak Vulnerability?

Some Reddit users have speculated that the broken scans are collateral damage from a rushed fix for ShieldBreak, a Defender privilege-escalation flaw published shortly after this month’s Patch Tuesday. It’s a reasonable theory — the timing lines up — but Microsoft hasn’t confirmed any connection, and independent write-ups have cautioned that timing alone isn’t proof of causation. Treat the ShieldBreak angle as unconfirmed context, not the explanation.

How to Fix It

The fix that has worked for most affected users is straightforward: update to a newer Security Intelligence version. Security Intelligence Update 1.457.236.0 resolved the crash for many people, though testing on August 19 showed it wasn’t universal — some machines needed 1.457.238.0 or a later package before a Quick Scan would complete without crashing. The version number matters less than the result: keep updating until a scan actually finishes.

1. Open Windows Security, go to Virus & threat protection > Virus & threat protection updates, and click Check for updates.
2. Run Windows Update as well, since engine and platform components sometimes arrive that way instead of through Defender’s own updater.
3. If Defender still won’t update or scans still fail, open an elevated Command Prompt and run MpCmdRun.exe -RemoveDefinitions -DynamicSignatures, then MpCmdRun.exe -SignatureUpdate to force a clean signature pull.
4. Administrators managing multiple endpoints can check current versions in bulk with the PowerShell cmdlet Get-MpComputerStatus rather than checking machines one at a time.

If none of that works and you genuinely cannot get a scan to complete, a System Restore to a point before August 16 is a last resort — but it also rolls back your malware definitions to an older, less current state, so it’s a tradeoff rather than a clean fix.

What Not to Do

Don’t reinstall Windows over this. Don’t dig into the registry hoping to manually rebuild Defender’s database. And don’t panic about infection just because a scan crashed — the pattern on clean installs argues against that. Reports so far suggest real-time protection generally keeps running even when a manually triggered scan crashes, so you’re not necessarily unprotected in the meantime. That said, if you can’t get any scan to complete and you’re dealing with a specific suspicious file, treat that as a separate problem: run a trusted second-opinion scanner on that file specifically rather than assuming a crashed Defender scan cleared it.

This is a different issue from the CVE fixes Windows Defender shipped earlier in August, which patched a critical remote-code-execution flaw and were unrelated to this scan-crashing bug. If you rely on a third-party antivirus alongside Defender, it’s worth checking that it’s current too — issues like Malwarebytes error code 20025 are a reminder that any AV engine can hit its own update problems independent of what Defender is doing.

FAQ