Microsoft has resolved a bug that caused Windows Defender to crash after a recent security update, resulting in 0xc0000005 access violation errors on some affected systems.
Microsoft Defender is a security software designed to provide real-time protection against malware, viruses, ransomware, and spyware on Windows, macOS, Linux, Android, and iOS devices.
According to reports on social media and Microsoft’s support site, users began seeing “Threat service has stopped. Restart it now” error messages on Windows 10 and Windows 11 devices starting Tuesday afternoon, prompting some affected customers to reinstall the operating system.
“Beginning this morning, quick or full scans are failing, and will occasionally fail to the point where the Defender service needs to be restarted,” one Windows system admin said.
“We came across this while responding to a separate infection – I chalked it up to Defender being borked due to the infection but then I was able to recreate the issue on other devices simply by initiating a Quick Scan.”
Microsoft has since confirmed this issue and told BleepingComputer that the bug has been addressed in a new signature update.
“We have addressed this with a fix and recommend customers apply the latest update or enable automatic updates,” a Microsoft spokesperson told BleepingComputer.
The company added that the fix will be applied automatically after installing Microsoft Defender Antivirus signature update version 1.457.236.0 or later.
Affected users are advised to update their systems via Windows Update, then check whether they have the latest security intelligence update installed.
In May, system administrators also reported that Microsoft Defender flagged DigiCert root certificate entries as Trojan:Win32/Cerdigent.A!dha malware, resulting in widespread false-positive alerts and, in some cases, removing certificates from the Windows trust store.
Months earlier, in December 2025, a widespread Microsoft Defender portal outage blocked access to some Defender XDR portal capabilities and disrupted threat hunting alerts.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
