CVE-2017-11903: Internet Explorer scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.5, a public exploit, and very high EPSS indicate a serious, readily exploitable memory corruption flaw in a widely deployed browser.

What it is

Internet Explorer mishandles objects in memory, causing a memory corruption condition in the scripting engine. A remote attacker who convinces a user to view a crafted page can corrupt memory and potentially execute code in the context of the logged-on user.

Impact

An attacker gains the same user rights as the current user, which can lead to code execution and full compromise if the user has administrative privileges.

Attack surface

Reached over the network via a crafted web page rendered by Internet Explorer; no authentication is required, but user interaction is needed to open the page or link.

Exploitation

A public exploit exists per the Exploit-DB reference, and EPSS is high (0.46826, 98.8th percentile), but the CVE is not listed in CISA KEV.

What to do

• Apply the Microsoft security update referenced in the vendor advisory.
• Migrate users off Internet Explorer to a supported browser.
• Restrict or block Internet Explorer usage through application control or policy.
• Enforce least privilege so browsing occurs without administrative rights.
• Filter or block known malicious sites and untrusted content at the network edge.

Detection

• Monitor for Internet Explorer crashes or abnormal process terminations on endpoints.
• Hunt for iexplore.exe spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Review proxy and DNS logs for access to known exploit or malicious hosting domains.
• Inspect memory or exploit artifacts on hosts where users visited untrusted sites.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.