Microsoft has resolved a bug that caused Windows Defender to crash after a recent security update, resulting in 0xc0000005 access violation errors on some affected systems.
Microsoft Defender is a security software designed to provide real-time protection against malware, viruses, ransomware, and spyware on Windows, macOS, Linux, Android, and iOS devices.
According to reports on social media and Microsoft’s support site, users began seeing “Threat service has stopped. Restart it now” error messages on Windows 10 and Windows 11 devices starting Tuesday afternoon, prompting some affected customers to reinstall the operating system.
“Beginning this morning, quick or full scans are failing, and will occasionally fail to the point where the Defender service needs to be restarted,” one Windows system admin said.
“We came across this while responding to a separate infection – I chalked it up to Defender being borked due to the infection but then I was able to recreate the issue on other devices simply by initiating a Quick Scan.”
Microsoft has since confirmed this issue and told BleepingComputer that the bug has been addressed in a new signature update.
“We have addressed this with a fix and recommend customers apply the latest update or enable automatic updates,” a Microsoft spokesperson told BleepingComputer.
The company added that the fix will be applied automatically after installing Microsoft Defender Antivirus signature update version 1.457.236.0 or later.
Affected users are advised to update their systems via Windows Update, then check whether they have the latest security intelligence update installed.
In May, system administrators also reported that Microsoft Defender flagged DigiCert root certificate entries as Trojan:Win32/Cerdigent.A!dha malware, resulting in widespread false-positive alerts and, in some cases, removing certificates from the Windows trust store.
Months earlier, in December 2025, a widespread Microsoft Defender portal outage blocked access to some Defender XDR portal capabilities and disrupted threat hunting alerts.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Microsoft working on Defender patch for ShieldBreak zero-day
Windows KB5121767 OOB update fixes shutdowns on some Dell PCs
Microsoft shares manual fix for WSUS sync delays and timeouts
Microsoft confirms Windows Server Update Services sync delays
Microsoft: Some Dell PCs shut down after recent Windows updates
Microsoft confirms GitHub is down worldwide
Hacker claims 3.6 million Azure account records stolen from major companies
Anthropic confirms Claude is down in major outage affecting multiple services
Certighost CVE is new. The privilege behind it isn’t. Discover where yours is hiding.
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
Signature-based prevention fell to 50%. See what your controls still stop.
Overdue a password health-check? Audit your Active Directory for free
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
