CVE-2017-11799: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, a public exploit and very high EPSS, though exploitation requires user interaction and high attack complexity.

What it is

ChakraCore and the Microsoft Edge scripting engine mishandle objects in memory, causing a memory corruption condition (CWE-119) that can be triggered by crafted content. Microsoft rates it 7.5 HIGH, and because the scripting engine runs in the browser process, successful corruption can lead to code execution in the user's context.

Impact

An attacker who triggers the flaw can execute arbitrary code with the privileges of the current user. On a typical workstation that means the attacker gains the user's access to data, credentials and network resources.

Attack surface

Reached over the network (AV:N) through the scripting engine, most likely by a user opening a malicious or compromised web page in Edge. The vector requires user interaction (UI:R) and no privileges (PR:N), and the high attack complexity (AC:H) indicates a non-trivial trigger.

Exploitation

Not listed in CISA KEV, but EPSS is 0.63675 (99.2nd percentile) and a public Exploit-DB entry (42998) exists, so working exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11799 as the first action.
• Upgrade or retire Windows 10 Gold, 1511, 1607, 1703 and Windows Server 2016 systems that cannot receive the patch.
• Keep Edge and any ChakraCore-based application current, since the flaw is in the shared scripting engine.
• Reduce exposure by restricting browsing to trusted sites and blocking known exploit-hosting domains at the network edge.

Detection

• Hunt for Edge or ChakraCore processes spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for a browser.
• Monitor for crashes or repeated faults in Edge/ChakraCore modules that could indicate exploitation attempts.
• Alert on network requests to domains or URLs associated with the public Exploit-DB proof of concept.
• Review endpoint telemetry for unusual memory-protection changes or shellcode-like behavior in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.