Microsoft Defender scan crashes with 0xc0000005? Update it first

Does your symptom match the August incident?

Reports began on August 18, 2026 after Defender security intelligence version 1.457.235.0 reached some Windows 10 and Windows 11 systems. Microsoft later told BleepingComputer that it had addressed the issue and recommended the latest update or automatic updates. The company identified 1.457.236.0 or later as the fixed baseline.

The match is stronger when several of these details line up:

• Quick Scan or Full Scan starts, then Windows Security closes or the scan ends unexpectedly
• Windows Security says “Threat service has stopped. Restart it now”
• Offline Scan stalls near 90 or 91 percent instead of completing
• an Application Error names mpengine.dll and exception code 0xc0000005
• the installed security intelligence is 1.457.235.0 or another pre-fix version
• the problem began suddenly around August 18 without a matching local security or policy change

One matching message is not enough to assign the cause. Defender service failures can also come from third-party antivirus, policy, damaged files, an incomplete update, or a different platform problem. The version check is the fastest safe discriminator because this incident already has a released fix.

Step 1: install the latest Defender security intelligence

Microsoft's current Windows Security path is:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection updates, select Protection updates.
4. Select Check for updates and let the update finish.

You can also open Settings > Windows Update and check for updates. Microsoft says Defender security intelligence normally arrives automatically through Windows Update. Use the current update offered to your PC; do not search for an old 1.457.236.0 package on a mirror. Microsoft's live release-note list already includes that version and many later 1.457 builds.

If Windows Update itself is stuck, keep that failure separate and use the Windows Update stage guide. Do not turn off antivirus or the firewall just to make the download move.

Step 2: read back the installed version and protection state

A completed update animation is not the receipt. Open PowerShell and run this read-only command:

Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated, AntivirusEnabled, RealTimeProtectionEnabled

Microsoft documents Get-MpComputerStatus as the Defender status command. Save the four returned values and the time. For this incident, AntivirusSignatureVersion must be 1.457.236.0 or later. A much newer version is expected as Microsoft continues publishing intelligence updates.

• Version is current, AntivirusEnabled is True, and RealTimeProtectionEnabled is True: continue to one controlled scan.
• Version is still older: the fix has not applied. Keep the repair on the update path.
• Version is current but protection is off: restart once if the service stopped, then check again. Do not browse casually or handle sensitive files while protection remains off.
• The command is unavailable or access is blocked: record the exact error and management state. Do not replace system tools with a download from another site.

If you use a non-Microsoft antivirus, Defender can enter a different running mode by design. Do not remove organization-approved security software just to force the values above.

Step 3: restart once if the threat service stopped

Save open work and restart Windows once after the current signature is installed. This gives the Defender service and engine a clean start. After sign-in, rerun the same status command before opening several apps or changing settings.

If the version rolled back or the service remains disabled, stop. Repeated restarts do not add evidence. Save the status result and use Microsoft's service-startup troubleshooting or your administrator's support path.

Step 4: run one Quick Scan

In Windows Security, open Virus & threat protection and select Quick scan. Keep the computer awake and let the scan finish. Record:

• start and finish time
• whether the window stayed open
• whether the service stopped
• the reported result
• the signature version used for the test

A completed Quick Scan with protection still enabled is a useful outcome check for this incident. It is not a guarantee that the PC is free of every threat, and it does not replace a deeper scan when Microsoft or a security professional has a specific reason for one.

Do not jump straight to repeated Full or Offline scans. During the incident, those paths failed too. One controlled Quick Scan tells you whether the released fix changed the original failure without creating another confusing loop.

If Defender still crashes on a current signature

Keep the failure evidence-first. Save a screenshot of the message, the four status fields, the scan time, Windows edition and build, recent security-software or policy changes, and whether the device is managed.

Microsoft's current scan-troubleshooting page places Defender events under:

Event Viewer
  Applications and Services Logs
    Microsoft
      Windows
        Windows Defender
          Operational

Look at events around the failed scan. If Windows also recorded an Application Error, note the faulting application, module, exception code, and timestamp. Redact usernames, device names, file paths, organization IDs, and other private details before sharing a screenshot or export.

If Windows Security or Settings itself will not open, use the separate Windows Settings app guide. If several unrelated apps freeze or the whole PC becomes unstable, move to the system-wide freezing path. Those symptoms are wider than the released Defender signature incident.

Do not erase the evidence

• do not disable real-time protection, Tamper Protection, firewall protection, or other security controls to make the scan appear to work
• do not add broad exclusions for Windows, user profiles, downloads, or whole drives
• do not delete Defender definitions, services, drivers, policies, or registry keys as a first step
• do not run definition-removal, platform-reset, or policy-deletion commands copied from a forum for this released-fix incident
• do not uninstall a current Windows security update or pause automatic security updates because one signature was bad
• do not reinstall or wipe Windows based on “Threat service has stopped” alone
• do not download signature packages, repair utilities, or scripts from unofficial mirrors

Microsoft has deeper service-repair steps for cases that remain broken after ordinary updates. Those actions can affect policy and platform state, so they belong after the current-version check, one restart, one verification scan, and an evidence review—not before.

Build a useful escalation record

• Windows edition, version, build, and management state
• AntivirusSignatureVersion and AntivirusSignatureLastUpdated
• AntivirusEnabled and RealTimeProtectionEnabled
• exact scan type, start time, failure time, and message
• whether 1.457.236.0 or later was installed before the test
• Windows Update result and restart result
• redacted Defender Operational and Application Error details
• other antivirus, recent security changes, and relevant organization policy
• the last known successful scan time, if available

This record tells support whether the released incident fix failed to apply, protection is still off, the scan engine still crashes, or the PC has moved into a different problem.

Where OmniMend fits

OmniMend on a supported Windows PC can help keep the Windows build, recent changes, exact error, version readback, protection state, and troubleshooting results together. It does not replace Microsoft Defender, scan files for malware, disable security controls, repair the Defender engine, or guarantee that a computer is clean.

Review what OmniMend can and cannot inspect, use the help center, or browse the evidence-first guide library. Keep real-time protection on, use the official update path, and redact system evidence before sharing it.