CVE-2017-0149: Internet Explorer memory corruption out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and CISA KEV listing indicate active exploitation, though user interaction and the legacy IE target reduce exposure.

What it is

Microsoft Internet Explorer 9 through 11 contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted web page is rendered. A remote attacker can exploit it to run arbitrary code in the context of the browser or crash it. The flaw is distinct from CVE-2017-0018 and CVE-2017-0037.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the IE process, or a denial of service through memory corruption.

Attack surface

Reached over the network by luring a user to a crafted web site; no authentication is required but user interaction (visiting the page) is needed per the CVSS vector AV:N/UI:R.

Exploitation

CVE-2017-0149 is listed in CISA KEV (added 2022-05-24), indicating known exploitation, and EPSS shows a 30-day probability of 0.29178 (98th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2017-0149) to all affected IE 9-11 installations.
• Retire or migrate off Internet Explorer 9-11 where possible, since the product is no longer supported.
• Enforce a modern browser as default and block IE rendering of untrusted sites via enterprise mode or site lists.
• Restrict browsing to trusted sites and disable ActiveX/scripting where IE must remain in use.

Detection

• Monitor for IE process crashes (iexplore.exe) with memory corruption fault offsets and correlate with recent web browsing.
• Hunt for iexplore.exe spawning child processes such as cmd.exe, powershell.exe or script hosts, which indicates post-exploitation.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to IE exploits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.