Vulnerability record · CVE-2017-0022 · published 17 March 2017
CVE-2017-0022: Microsoft XML Core Services memory handling allows file existence disclosure
Microsoft · Xml Core Services
MSXML in multiple Windows versions improperly handles objects in memory, letting a crafted web site probe for files on the local disk. The flaw is an information disclosure issue, not code execution, but it leaks host file presence to a remote page. It affects a broad set of legacy Windows client and server releases.
Description
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Automated analysis
high priorityIt is in CISA KEV with a public exploit reference and a high EPSS percentile, though impact is limited to information disclosure and requires user interaction.
What it is
MSXML in multiple Windows versions improperly handles objects in memory, letting a crafted web site probe for files on the local disk. The flaw is an information disclosure issue, not code execution, but it leaks host file presence to a remote page. It affects a broad set of legacy Windows client and server releases.
Impact
An attacker learns whether specific files exist on the victim's machine, which can fingerprint installed software, users, or security tooling. No data contents are exposed, only file existence.
Attack surface
Reached over the network via a crafted web site that triggers MSXML parsing; the CVSS vector shows no privileges required but user interaction is required, meaning the victim must visit or open the malicious page.
Exploitation
CISA added it to KEV in May 2022, and an exploit-kit reference is tagged Exploit, indicating real-world exploitation; EPSS 30-day probability is about 18% (97th percentile). No ransomware use is documented.
What to do
- Apply the Microsoft security update for CVE-2017-0022 on all affected Windows versions.
- Prioritize patching internet-facing and user-workstation systems still running Windows 7, 8.1, RT 8.1, Vista, or the listed Server releases.
- Retire or isolate end-of-life Windows versions that no longer receive MSXML fixes.
- Restrict browsing to trusted sites and block known exploit-kit delivery domains at the network edge.
Detection
- Monitor for MSXML-related process activity (e.g., msxml*.dll loads) spawned from browser or document processes.
- Alert on exploit-kit referral patterns and known malicious landing pages in web proxy or DNS logs.
- Hunt for unusual file-probing behavior from browser processes accessing local paths outside normal profile directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-0022 to the Known Exploited Vulnerabilities catalog on 24 May 2022 as "Microsoft XML Core Services Information Disclosure Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 14 June 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96069 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038014 | Broken LinkThird Party AdvisoryVDB Entry |
| https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html | Exploit |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/96069 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038014 | Broken LinkThird Party AdvisoryVDB Entry |
| https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html | Exploit |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0022 | US Government Resource |
Track CVE-2017-0022 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0022), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
