CVE-2017-11855: Internet Explorer memory corruption allows code execution as the current user

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityA public exploit exists and EPSS is very high, but exploitation requires user interaction and the affected browser is legacy, keeping it below critical.

What it is

Internet Explorer mishandles objects in memory, producing a memory corruption condition (CWE-119) that can be triggered by a crafted page. Because the flaw lets an attacker run code with the rights of the logged-in user, it matters on any system where IE is still used or reachable, including legacy Windows versions listed by the vendor.

Impact

An attacker who successfully triggers the flaw gains the same privileges as the current user, enabling arbitrary code execution in that user's context. On accounts with administrative rights, that can extend to full control of the host.

Attack surface

Reached over the network via a crafted web page or content rendered by Internet Explorer; the CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open or view the malicious content. No authentication is needed to deliver the trigger.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (43371) exists and EPSS is high at roughly 0.49 (98.8th percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) on all affected Windows versions.
• Retire or disable Internet Explorer where possible and force browsing through a supported, modern browser.
• Restrict or block access to untrusted web content and known exploit-hosting sites at the network edge.
• Run users with least privilege so a successful exploit yields limited rights.
• Enable exploit protection features (e.g., EMET successor mitigations in Windows Defender Exploit Guard) for legacy IE use cases.

Detection

• Monitor for Internet Explorer (iexplore.exe) crashes or abnormal child processes spawning from it, which can indicate memory corruption exploitation.
• Hunt for Office documents or links that launch IE unexpectedly, a common delivery path for browser memory corruption exploits.
• Review proxy and DNS logs for connections to known exploit kit or malicious hosting infrastructure.
• Alert on suspicious post-exploitation behavior from IE, such as script interpreters or system tools launched as children of iexplore.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.