This vulnerability is a code injection flaw in Microsoft Defender for Endpoint for Linux that allows an attacker to run arbitrary code on an affected host. The flaw arises from improper validation when generating code, giving the attacker the ability to execute unauthorized commands and compromise confidentiality, integrity, and availability of the system. The weakness is identified as CWE‑94.

Microsoft Defender for Endpoint for Linux is affected, but the specific impacted releases or version ranges are not listed in the advisory. Potential victims are Linux systems that have installed the Defender for Endpoint extension and have not applied the latest update from Microsoft.

The CVSS base score of 8.8 denotes a high severity and indicates that remote code execution is possible. The EPSS score indicates the likelihood of exploitation is very low (< 1%), and the vulnerability does not appear in the CISA KEV catalog at present. Attackers are inferred to need network access to the victim host, likely through adjacent network connections that expose the Defender for Endpoint service. The vulnerability can be exercised by sending specially crafted input that triggers the code generation mechanism, leading to execution in the context of the service.