CVE-2017-11893: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, a public exploit, and very high EPSS (99.3rd percentile) outweigh the required user interaction and absence from KEV.

What it is

CVE-2017-11893 is a memory corruption flaw in how the ChakraCore scripting engine handles objects in memory, affecting Microsoft Edge and ChakraCore on Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016. Successful exploitation lets an attacker run arbitrary code in the context of the current user, making it a serious browser-engine remote code execution issue.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, which can lead to full system compromise if that user has administrative rights. Typical outcomes include data theft, installation of malware, or further lateral movement from the victim host.

Attack surface

Reached over the network via a crafted web page or content that triggers the scripting engine, per the CVSS vector AV:N. No privileges are required (PR:N) but user interaction is required (UI:R), meaning the victim must open or view the malicious content in Edge or a ChakraCore host.

Exploitation

A public exploit exists (Exploit-DB 43466) and EPSS is very high at 0.685 (99.3rd percentile), though the CVE is not listed in CISA KEV. The presence of a working public exploit plus high EPSS indicates meaningful real-world exploitation risk.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Upgrade or migrate off unsupported Windows 10 builds (1511, 1607, 1703, 1709) to a currently supported release.
• If ChakraCore is embedded in an application, update it to a patched version or disable the affected scripting component where feasible.
• Enforce browser hardening such as Enhanced Mitigation Experience Toolkit/Exploit Protection and restrict browsing to trusted sites to reduce exposure.
• Limit user privileges so that a successful exploit runs with minimal rights.

Detection

• Monitor for Edge or ChakraCore processes spawning unexpected child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Alert on crashes or abnormal terminations of MicrosoftEdge.exe or ChakraCore hosts that correlate with suspicious web content.
• Hunt for known exploit artifacts and shellcode patterns tied to Exploit-DB 43466 in browser memory or network traffic.
• Review proxy and DNS logs for delivery of exploit pages to endpoints running affected Windows 10 builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.