Defender signature 1.457.235.0 aborts virus scans on Windows 11 and 10 (August 19, 2026)

What the scan failure looks like

A Quick Scan or a Full Scan starts normally, runs for a while, and then stops with the message 'the threat service has stopped'. Restarting Windows Security does not change the outcome. An Offline scan behaves differently: it hangs at roughly 90 to 93 percent and does not finish.

Underneath, Cyber Security News reports the antimalware service process MsMpEng.exe crashing inside mpengine.dll with exception 0xC0000005, an access violation. That is the scanning engine itself falling over, which is why restarting the app on top of it achieves nothing.

Microsoft Safety Scanner was affected the same way, while some manual full-drive scans still completed. That split points at the scheduled scan path rather than at scanning as a whole, and it is also the reason the fault was easy to miss: a machine can look healthy in Windows Security while its scheduled scans have not completed in days.

The versions involved

This is a definition and engine problem, not a Windows update problem, so there is no KB number attached to it. The affected Malware Protection Engine versions are 1.1.26070.7 and 1.1.26080.2, and the security intelligence updates named are 1.457.222.0, 1.457.225.0, 1.457.226.0, 1.457.227.0, 1.457.230.0 and 1.457.235.0.

The recovery marker is 1.457.236.0. Cyber Security News reports that version restored functionality, with some systems needing 1.457.238.0 or newer. Both Windows 10 and Windows 11, including 25H2, are in scope, because Defender definitions ship on their own schedule to all of them.

What Microsoft has and has not said

The acknowledgement here is indirect. Microsoft shipped corrected definitions, and that is the whole of it. As of August 19, 2026 there is no incident notice, no known-issue entry and no statement naming the trigger, the affected editions or the rollout scope.

That leaves one honest way to check a PC: read its version numbers. If a machine is on security intelligence 1.457.236.0 or newer and its scans complete, it is out of the affected window. There is no advisory to consult and no ticket to follow.

It also leaves a real question open. Nobody has published what in the definition package caused the engine to fault, so nobody outside Microsoft can say whether the corrected version removed the cause or removed the trigger.

Also on August 19: the game-crash known issue opened

A separate Windows fault got its formal acknowledgement the same day. Microsoft Learn release health carries a known issue headed 'Some games become unresponsive when certain drivers are present', stamped Opened: 2026-08-19, 17:50 PT, with OS Build 26100.9168, KB5121003 of August 11, 2026 as the originating update.

Those are the crashes covered in the August 16 post, which had been user reports until this entry appeared. The Defender scan problem described above is unrelated to it: different component, different versions, no shared cause published.

What you can do today

If your scans are aborting, the goal is to get the machine onto corrected definitions and confirm it. In order:

1. Force a definition update. Open Windows Security, then Virus and threat protection, then Protection updates, and choose Check for updates.

2. Read the version back. In Windows Security, open Settings, then About, which lists the engine and security intelligence versions. You want security intelligence 1.457.236.0 or newer.

3. Run a Quick Scan and let it finish. If it still aborts on a corrected version, note the engine version as well, because some systems needed 1.457.238.0 or newer.

4. If the machine has to be scanned now and cannot be, run a third-party antivirus to cover the gap until Defender updates itself.

5. Keep System Restore as the last resort. A restore to August 16 was the documented escape, and it costs you every detection update since then, which leaves the machine scanning with older definitions.

6. Confirm a scan has actually completed, rather than reading the summary screen. In these reports some manual full-drive scans finished while the scheduled scan path failed, so the two are worth checking separately.

7. If you would rather not chase version numbers by hand: Get XLAnt.