CVE-2017-0089: Microsoft Uniscribe memory corruption remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS plus a public Exploit-DB entry, but exploitation requires user interaction and the affected platforms are legacy.

What it is

Uniscribe in Windows Vista SP2, Server 2008 SP2/R2 SP1 and Windows 7 SP1 mishandles crafted input, causing a memory buffer overflow (CWE-119) that can lead to remote code execution. The flaw is reachable through a crafted web site, so browsing to attacker-controlled content is enough to trigger it. It matters because the affected platforms are legacy but still deployed, and the vendor classifies it as a remote code execution issue.

Impact

An attacker who successfully triggers the overflow can execute arbitrary code in the context of the affected process on the victim's machine. That gives code execution without prior privileges on the target.

Attack surface

Reached over the network via a crafted web site, per the description and the CVSS vector AV:N/AC:L/PR:N/UI:R. No authentication is required, but user interaction (visiting the page) is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.57338 (99.03 percentile), and an Exploit-DB entry (41652) is referenced, indicating public exploit material exists. No ransomware group use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0089 on all affected Windows versions.
• Prioritize patching Windows 7 SP1, Vista SP2, and Server 2008 SP2/R2 SP1 systems that still receive security updates or are covered by extended support.
• Where legacy systems cannot be patched, restrict browsing to trusted sites and block untrusted web content at the network boundary.
• Reduce exposure of unpatched legacy hosts by isolating them from general internet access.
• Track remaining unpatched instances and plan migration off end-of-support platforms.

Detection

• Monitor for crashes or abnormal process termination in Uniscribe-related components (usp10.dll) on affected hosts.
• Hunt for suspicious child processes spawned by browser or document-rendering processes on legacy Windows systems.
• Review proxy and web logs for access to known exploit-hosting or malicious sites from affected hosts.
• Correlate endpoint telemetry for memory corruption indicators in processes that load usp10.dll.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.