Microsoft has just issued an advisory about a vulnerability in the Microsoft Malware Protection Engine. If the said flaw is exploited, elevated privileges are granted to a local user once the engine starts to scan after a system is infiltrated by an attacker using valid login credentials and has created a specially crafted registry key. This, in turn, may grant the attacker the same privileges as the local user. Microsoft has also found that anonymous users could not exploit this vulnerability.
For more information, please refer to this Microsoft page: