CVE-2017-11890: Internet Explorer Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityPublic exploit code and a very high EPSS score make this attractive to attackers, though the high attack complexity and required user interaction temper the risk.

What it is

Internet Explorer mishandles objects in memory, causing a memory corruption condition (CWE-119) that can be triggered by crafted content. Microsoft addressed it in the December 2017 updates across Windows 7 through Windows 10 and corresponding server releases. Because IE is still present on many of these platforms, unpatched hosts remain exposed to code execution in the user's context.

Impact

An attacker can execute arbitrary code with the privileges of the current user. That typically means full control of the browsing session and any data or credentials the user can reach, with further host compromise possible if the user has elevated rights.

Attack surface

Reached over the network (AV:N) through IE rendering of attacker-controlled content, with user interaction required (UI:R) and no authentication needed (PR:N). The high attack complexity (AC:H) indicates the memory corruption is not trivially reliable.

Exploitation

A public exploit exists (Exploit-DB 43369), and EPSS is high at roughly 0.50 (98.8th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the Microsoft December 2017 security updates for all affected Windows versions, prioritizing Windows 7 SP1, Server 2008/R2, 8.1/RT 8.1, Server 2012/R2, Windows 10 builds through 1709, and Server 2016.
• Retire or disable Internet Explorer where possible and standardize users on a supported browser.
• Enforce Enhanced Protected Mode / 64-bit IE and other IE hardening where IE must remain.
• Block or restrict untrusted web content at the network and email gateway, and limit users' ability to browse arbitrary sites.
• Run users without local administrator rights to reduce the value of code execution in the user context.

Detection

• Hunt for IE (iexplore.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe or rundll32.exe.
• Monitor for crashes or memory-corruption indicators in iexplore.exe and for unusual outbound connections from IE processes.
• Alert on known exploit artifacts tied to Exploit-DB 43369 and on hosts still missing the December 2017 cumulative updates.
• Review proxy and DNS logs for users reaching pages that deliver IE-targeted exploit kits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.