The holders won thanks to Karim Benzema's strike 12 minutes from time, after Sergio Sanchez and Martin Demichelis put Malaga on course for a win in the capital with goals in the 10th and 29th minutes.
Sami Khedira (68) and Gonzalo Higuain (70) brought Jose Mourinho's team level before France forward Benzema netted the winner, although they still have a tough job on their hands to win the tie.
The winners will take on Barcelona in the quarter-finals if Pep Guardiola's men are able to see off Osasuna over two legs.
Third division Mirandes are on course for an upset after Pablo Infante Munoz and Mikel Martins gave them a 2-0 win over Racing Santander while Albacete, in the same division as Mirandes, held Athletic Bilbao goalless.
Second-tier side Alcorcon - who famously knocked out Real Madrid two seasons ago, hold the edge against Levante after beating the top-flight side 2-1.
Borja Perez (13) and Nagore (52) scored the goals for Alcorcon, with Miguel Pallardo having equalised for Levante in the 23rd minute.