CVE-2017-0202: Internet Explorer memory corruption remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a browser with public exploit code and very high EPSS percentile, though it requires user interaction and no KEV listing.

What it is

Internet Explorer improperly accesses objects in memory, corrupting memory in a way that allows arbitrary code execution in the context of the current user. Because the affected component is a widely deployed browser, a successful attack can hand an attacker the user's privileges on the workstation. The record does not list specific affected IE versions or platforms.

Impact

An attacker who lands the exploit gains arbitrary code execution as the current user, enabling data theft, installation of malware, or further lateral movement from the victim's session.

Attack surface

Reached over the network via a crafted web page or content that triggers the faulty object access in Internet Explorer. The CVSS vector shows no privileges required but user interaction required, so the victim must visit or open attacker-controlled content.

Exploitation

Not listed in CISA KEV, but EPSS is 0.45648 (98.7th percentile) and a public Exploit-DB entry (41941) exists, indicating exploit code is publicly available and exploitation is plausible.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2017-0202) on all systems running Internet Explorer.
• Retire or migrate off Internet Explorer where possible; if it must remain, restrict browsing to trusted sites and disable unnecessary ActiveX and scripting features.
• Enforce email and web filtering to block known exploit pages and malicious attachments that target IE.
• Run browsers and users with least privilege so code execution does not yield administrative rights.
• Keep EMET or equivalent exploit mitigations enabled on legacy systems that cannot be patched.

Detection

• Monitor for Internet Explorer crashes or unexpected process terminations that may indicate memory corruption attempts.
• Hunt for iexplore.exe spawning child processes such as cmd.exe, powershell.exe, or script hosts, which is abnormal for normal browsing.
• Review proxy and DNS logs for access to known exploit-hosting domains or the Exploit-DB 41941 payload delivery patterns.
• Correlate endpoint telemetry for suspicious memory or shellcode behavior in iexplore.exe with recent patch status of the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.