CVE-2017-11937 has not yet been exploited in the wild – that’s what Redmond says. Because it is an out-of-band critical fix, however, it should be installed as soon as possible. For most users, this will happen automatically.
The security hole is present in Windows Defender and Microsoft Security Essentials, as well as Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016. The bug was discovered and reported by the UK’s National Cyber Security Centre – which is a part of GCHQ.
According to Microsoft, the vulnerability can be triggered when the Malware Protection Engine scans a downloaded file to check for threats. In many systems this is set to happen automatically for all new files.