Vulnerability record · CVE-2017-11809 · published 13 October 2017
CVE-2017-11809: Microsoft Edge and ChakraCore scripting engine memory corruption
Microsoft · Chakracore
ChakraCore and Microsoft Edge mishandle objects in memory in the scripting engine, causing a memory corruption condition (CWE-119). An attacker who gets a victim to load crafted content can run arbitrary code in the context of the current user, which matters because the browser and script engine run with the user's privileges.
Description
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.5 with high EPSS and a public exploit raise the risk, though exploitation requires user interaction and the affected platforms are older.
What it is
ChakraCore and Microsoft Edge mishandle objects in memory in the scripting engine, causing a memory corruption condition (CWE-119). An attacker who gets a victim to load crafted content can run arbitrary code in the context of the current user, which matters because the browser and script engine run with the user's privileges.
Impact
Successful exploitation gives the attacker arbitrary code execution as the current user, enabling data theft, installation of malware, or further compromise of the host within that user's rights.
Attack surface
Reached over the network (AV:N) through crafted web content or script processed by Edge or ChakraCore; no privileges are required (PR:N) but the victim must interact, such as visiting a page or opening a document (UI:R).
Exploitation
Not listed in CISA KEV, but EPSS is high (0.68027, 99.3rd percentile) and a public Exploit-DB entry (42999) exists, indicating exploit code is available.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11809.
- Keep Edge, ChakraCore and Windows 10/Server 2016 builds current with all cumulative updates.
- Restrict or block untrusted web and script content through network filtering and browser hardening where feasible.
- Reduce reliance on the affected legacy Edge/ChakraCore engine by migrating to a supported, updated browser.
Detection
- Monitor for Edge or ChakraCore process crashes and abnormal memory corruption events on endpoints.
- Hunt for suspicious child processes spawned by browser processes, such as script interpreters or command shells.
- Review proxy and DNS logs for access to known exploit-hosting or malicious sites serving crafted content.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/101137 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039532 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11809 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42999/ | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/101137 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039532 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11809 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42999/ | Third Party AdvisoryVDB Entry |
Track CVE-2017-11809 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-11809), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
