CVE-2017-11810: Internet Explorer scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, but it requires user interaction and affects only legacy Internet Explorer on older Windows builds.

What it is

Internet Explorer's scripting engine mishandles objects in memory, producing a memory corruption condition (CWE-119) that can be triggered by crafted content. Because the flaw sits in the scripting engine, successful exploitation runs code in the context of the current user, and the affected platform list spans Windows 7 through Windows 10 and corresponding server releases.

Impact

An attacker who lands the exploit gains arbitrary code execution with the privileges of the logged-in user, which can lead to full system compromise if that user has administrative rights.

Attack surface

The CVSS vector is network-reachable (AV:N) with no privileges required (PR:N) but requires user interaction (UI:R), consistent with a victim opening a malicious page or document that invokes the IE scripting engine.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.548, ~99th percentile) and a public Exploit-DB entry (43131) exists, indicating exploit code is available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11810 on all affected Windows versions.
• Retire or restrict Internet Explorer; move users to a supported browser and block IE execution where business needs allow.
• Enforce Protected Mode and disable ActiveX/scripting for untrusted zones to reduce scripting engine exposure.
• Limit user privileges so code execution does not immediately yield administrative rights.
• Filter or block known exploit traffic and untrusted web content at the network and email gateways.

Detection

• Monitor for IE (iexplore.exe) crashes or abnormal child process creation, especially Office or browser processes spawning cmd.exe, powershell.exe or script hosts.
• Hunt for exploitation artifacts tied to public PoC 43131 in endpoint telemetry and proxy logs.
• Alert on suspicious outbound connections or payload downloads originating from iexplore.exe.
• Review Windows event logs and EDR data for memory corruption crash patterns in the scripting engine on affected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.