Vulnerability record · CVE-2017-0070 · published 17 March 2017
CVE-2017-0070: Microsoft Edge scripting engine use-after-free remote code execution
Microsoft · Edge
A use-after-free flaw in the way Microsoft scripting engines render objects in memory in Microsoft browsers lets memory be corrupted. Successful exploitation allows arbitrary code to run in the context of the current user, so the impact scales with that user's privileges.
Description
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, a public exploit reference, and a very high EPSS score, though exploitation requires user interaction and no KEV listing exists.
What it is
A use-after-free flaw in the way Microsoft scripting engines render objects in memory in Microsoft browsers lets memory be corrupted. Successful exploitation allows arbitrary code to run in the context of the current user, so the impact scales with that user's privileges.
Impact
An attacker gains code execution at the privilege level of the logged-on user, which can mean full system control if that user is an administrator. From there the attacker can install programs, view, change or delete data, or create accounts with full rights.
Attack surface
The vulnerability is reached over the network through browser rendering of malicious content, with no privileges required but user interaction required per the CVSS vector (AV:N/AC:H/PR:N/UI:R). The affected product listed is Microsoft Edge.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high (0.78538, 99.56th percentile) and an Exploit-DB entry (41623) is referenced, indicating public exploit code exists.
What to do
- Apply the Microsoft security update referenced in the vendor advisory for CVE-2017-0070.
- Keep Microsoft Edge and the underlying scripting engines current on all supported Windows versions.
- Restrict or disable scripting engine components where operationally feasible and enforce least privilege so users do not browse with administrative rights.
- Block or filter untrusted web content and known exploit hosts at the network boundary.
- Retire or isolate unsupported Windows versions that cannot receive the patch.
Detection
- Monitor for browser processes spawning unexpected child processes such as script interpreters or command shells.
- Hunt for crashes or memory corruption events in Edge and scripting engine processes that precede suspicious execution.
- Review proxy and DNS logs for access to known exploit-hosting or malicious domains tied to this CVE.
- Alert on anomalous process creation or file writes originating from browser sessions on endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96690 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038006 | |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0070 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/41623/ | |
| http://www.securityfocus.com/bid/96690 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038006 | |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0070 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/41623/ |
Track CVE-2017-0070 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0070), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
