CVE-2017-11870: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5, public exploit code, and a very high EPSS score make this a serious risk despite the lack of KEV listing.

What it is

CVE-2017-11870 is a memory corruption flaw in how the ChakraCore scripting engine handles objects in memory, affecting Microsoft Edge on Windows 10 1703, 1709 and Windows Server 1709. Successful exploitation lets an attacker run code with the same rights as the current user, so the impact depends on the privileges of the browsing user.

Impact

An attacker can corrupt memory in the scripting engine and execute arbitrary code in the context of the current user. If that user has administrative rights, the attacker can take full control of the system.

Attack surface

The vulnerability is reached over the network through a crafted web page rendered by Microsoft Edge or content processed by ChakraCore. No authentication is required, but user interaction is needed because the victim must open or view the malicious content.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.59642 (99th percentile) and a public Exploit-DB entry (43182) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11870.
• Upgrade or remove unsupported Windows 10 1703/1709 and Windows Server 1709 systems.
• Restrict or disable Microsoft Edge and ChakraCore-based scripting where not required.
• Enforce least privilege so browsing users do not run with administrative rights.
• Block known malicious sites and untrusted script content at the network and email layers.

Detection

• Monitor for Microsoft Edge or ChakraCore process crashes that may indicate memory corruption attempts.
• Hunt for suspicious child processes spawned by Edge or ChakraCore, such as script interpreters or command shells.
• Review proxy and DNS logs for access to known exploit or malicious hosting domains.
• Use EDR to alert on anomalous memory operations or code execution originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.