Researchers claim Windows Defender can be fooled into deleting databases

Researchers demonstrated that byte-signature detections in EDR products (Microsoft Defender and Kaspersky EDR) can be manipulated by embedding malware byte signatures into benign files (for example via user names, database entries, or comments) causing the EDR to falsely classify and delete those files. SafeBreach responsibly disclosed multiple bypasses to Microsoft (resulting in CVE-2023-24860 and CVE-2023-36010) and reported mitigations, while cautioning that such deletion vulnerabilities are hard to fully eliminate and can have severe irreversible impact if exploited at scale.