CVE-2017-0037: Microsoft Edge and IE mshtml type confusion enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution, is listed in CISA KEV with confirmed exploit references, and has an EPSS score above 0.80, so unpatched systems are at immediate risk.

What it is

Microsoft Internet Explorer 10 and 11 and Microsoft Edge contain a type confusion flaw in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll. A crafted CSS token sequence combined with JavaScript operating on a TH element can corrupt memory and lead to arbitrary code execution. The flaw is remotely reachable and has been exploited in the wild, making it a serious risk for unpatched browsers.

Impact

An attacker can execute arbitrary code in the context of the affected browser process, giving them the ability to run code as the logged-on user. Depending on privileges, this can lead to full system compromise.

Attack surface

Reached remotely over the network, typically by a user visiting a crafted web page or opening malicious content in IE or Edge. The CVSS vector shows no privileges required and no user interaction (PR:N/UI:N), though in practice delivery usually relies on the victim loading attacker-controlled content.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-28, and multiple references are tagged as Exploit, including Exploit-DB entries and a Project Zero issue. EPSS is very high at 0.804 (99.6th percentile), indicating active exploitation is likely.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) to all affected IE 10, IE 11 and Edge installations.
• Retire or isolate Internet Explorer and legacy Edge where patching is not possible, and enforce a modern supported browser.
• Block or restrict access to untrusted web content and disable legacy browser rendering modes in enterprise configurations.
• Monitor for and remove unpatched browser versions from endpoints using software inventory and vulnerability scanning.

Detection

• Hunt for browser processes (iexplore.exe, MicrosoftEdge.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for normal browsing.
• Monitor for crashes in mshtml.dll, especially involving Layout::MultiColumnBoxBuilder, as a possible exploitation attempt.
• Review proxy and DNS logs for known exploit-hosting domains and for traffic to sites delivering the crafted CSS/JavaScript payloads.
• Alert on suspicious file writes or registry changes originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.