Defender Scan Stuck at 80% on Windows? Microsoft Has Fixed the Bug

Is Microsoft Defender crashing at the end of a quick scan on your Windows PC? You're not alone. This is a known issue, and Microsoft has now released a fix. Could it be related to the upcoming patch for the ShieldBreak flaw? Here's what we know.

A scan that stops at 80%, and a Windows service that crashes

Here is the scenario reported by many users over the past few hours: the quick scan progresses normally, then after a while, it stops at around 75 to 80 percent completion. This halt is accompanied by the message: "Threat service has stopped. Restart it now".

Behind this message is actually the crash of the MsMpEng.exe process, which corresponds to the Antimalware Service Executable. In Windows Event Viewer, there is also an error, including code 0xc0000005.

By browsing Microsoft Q&A, we can understand that:

• Quick and full scans stop just before the end, with no usable result.
• Offline scanning also fails.
• Only the custom scan of a specific folder continues to work.
• The usual reflex of trying to repair the OS with sfc /scannow and DISM does not change anything.

Worst of all, some users even reinstalled their PC thinking a piece of malware was blocking Microsoft Defender. In reality, that is not the case at all...

Microsoft confirms the bug and fixes it through a signature update

Microsoft has acknowledged the issue, and there is even a solution! That solution is actually a new signature update that you need to install on your PC. To be precise, the fix is included starting with Microsoft Defender platform version 1.457.236.0 (which is no longer the latest version today). This is simply a definition update (maybe the database was corrupted?), not a full update to install (so no new KB).

In this case, what I recommend is running the PowerShell command Get-MpComputerStatus, because it exposes the signature database versions. You can also run Update-MpSignature, since it forces Windows to retrieve the latest definitions from Microsoft servers.

When I heard about this bug, I immediately thought of the ShieldBreak flaw. Indeed, this is a zero-day vulnerability in Defender (CVE-2026-69414) that Microsoft was trying to patch. You have to admit the timing is odd: Microsoft prepares a patch for Defender, and suddenly Defender starts acting up... However, Microsoft has not officially mentioned any link to the ShieldBreak flaw.

Have your devices been affected by this Defender bug?

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio