Vulnerability record · CVE-2017-0141 · published 17 March 2017
CVE-2017-0141: Microsoft Edge scripting engine memory corruption remote code execution
Microsoft · Edge
Microsoft browser scripting engines mishandle objects in memory, allowing memory corruption that can lead to arbitrary code execution. The flaw affects Microsoft Edge and is distinct from a long list of related scripting engine CVEs patched in the same cycle. It matters because successful exploitation runs code at the privilege level of the browsing user.
Description
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0150, and CVE-2017-0151.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 3.0 base score is 7.5 (HIGH) with network reachability and high EPSS, though exploitation requires user interaction and no KEV listing is present.
What it is
Microsoft browser scripting engines mishandle objects in memory, allowing memory corruption that can lead to arbitrary code execution. The flaw affects Microsoft Edge and is distinct from a long list of related scripting engine CVEs patched in the same cycle. It matters because successful exploitation runs code at the privilege level of the browsing user.
Impact
An attacker gains code execution in the context of the current user, which can mean full system control if that user has administrative rights, including installing programs, altering or deleting data, and creating accounts.
Attack surface
Reached over the network through a crafted web page rendered by the affected browser; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must visit or open attacker-controlled content.
Exploitation
Not listed in CISA KEV, but EPSS is high at roughly 0.48 (98.8th percentile), indicating elevated predicted exploitation activity; references include a Packet Storm entry titled Microsoft ChakaCore Remote Code Execution, though the record does not state whether a public exploit exists.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0141.
- Keep Microsoft Edge and the underlying Windows scripting components current on all supported systems.
- Restrict or disable scripting engine components where business needs allow, and block untrusted web content at the network edge.
- Run browsers with standard user rights so exploitation does not yield administrative control.
- Retire or isolate unsupported Windows versions that cannot receive the patch.
Detection
- Hunt for browser or scripting engine processes (Edge, Chakra) spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
- Monitor for unusual outbound connections or file writes originating from browser processes.
- Review crash telemetry and Windows Error Reporting for repeated scripting engine faults on endpoints.
- Search proxy and DNS logs for known exploit-hosting or malvertising domains tied to browser exploit campaigns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-0141 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-0141), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
