CVE-2017-11793: Internet Explorer scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with a public exploit and very high EPSS, though exploitation requires user interaction and the flaw is dated.

What it is

Internet Explorer's scripting engine mishandles objects in memory, producing a memory corruption condition (CWE-119) that can be triggered by crafted content. Microsoft rated it a scripting engine memory corruption vulnerability affecting IE on a broad set of Windows client and server releases. Because the engine runs in the browser process, successful corruption can lead to code execution in the user's context.

Impact

An attacker who triggers the flaw can execute arbitrary code with the privileges of the current user. On a typical workstation that means the attacker's code inherits the user's rights, enabling data theft, installation of malware, or further lateral movement.

Attack surface

The CVSS vector is network-reachable (AV:N) with user interaction required (UI:R) and no privileges required (PR:N), consistent with a victim visiting a malicious or compromised web page in Internet Explorer. No authentication is needed; the attack depends on the user opening the crafted content.

Exploitation

CISA KEV does not list this CVE, but a public Exploit-DB entry (43368) exists and EPSS is high at roughly 0.50 (98.8th percentile), indicating meaningful exploitation likelihood. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2017-11793) to all affected Windows and IE versions.
• Retire or disable Internet Explorer where possible and standardize users on a supported browser.
• Enforce Enhanced Protected Mode / Protected Mode and other IE hardening settings on systems that must keep IE.
• Restrict browsing to trusted sites and block known malicious or untrusted content through network and endpoint controls.
• Maintain endpoint detection and response coverage on IE processes to catch post-exploitation behavior.

Detection

• Monitor for Internet Explorer (iexplore.exe) crashes or abnormal child processes, which can indicate scripting engine exploitation attempts.
• Alert on suspicious process creation where iexplore.exe spawns command shells, scripting hosts, or other unexpected binaries.
• Hunt for known public exploit patterns for this CVE in web proxy, IDS/IPS, and email/web gateway logs.
• Review endpoint telemetry for memory corruption indicators and unusual script engine activity on hosts still running IE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.