CVE-2017-0222: Internet Explorer memory corruption out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityConfirmed in-the-wild exploitation (KEV) and a high CVSS of 8.8 with remote code execution impact, though exploitation requires user interaction.

What it is

Internet Explorer improperly accesses objects in memory, causing an out-of-bounds write (CWE-787) that can be turned into remote code execution. The flaw is remotely reachable and requires the victim to interact with a crafted page, making it a browser-based drive-by risk. It is listed in CISA's Known Exploited Vulnerabilities catalog, so real-world exploitation is confirmed.

Impact

An attacker who successfully triggers the memory corruption can execute arbitrary code in the context of the Internet Explorer process, giving full control of confidentiality, integrity and availability on the victim host.

Attack surface

Reached over the network via a crafted web page or content rendered by Internet Explorer; no authentication is required, but user interaction (opening or viewing the malicious content) is needed per the CVSS vector UI:R.

Exploitation

CISA added this CVE to the KEV catalog on 2022-02-25 with a required action to apply vendor updates, confirming exploitation in the wild; EPSS gives a 30-day probability of 0.29645 (98th percentile), indicating high predicted activity. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Retire or disable Internet Explorer where possible and move users to a supported browser.
• Enforce Enhanced Protected Mode / 64-bit IE and other IE hardening settings on systems that must keep the browser.
• Block or restrict untrusted web content and apply network filtering for known malicious sites.
• Track KEV remediation deadlines (due 2022-08-25) and verify patched status across the estate.

Detection

• Hunt for IE process crashes or memory corruption events (e.g., Application Error / Windows Error Reporting) tied to iexplore.exe.
• Monitor for iexplore.exe spawning unexpected child processes such as cmd.exe, powershell.exe or script hosts.
• Review proxy and DNS logs for IE user agents reaching known exploit-hosting or malvertising domains.
• Audit endpoint inventory for unpatched Internet Explorer versions against the Microsoft advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.