CVE-2017-11907: Internet Explorer scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with public exploit code and very high EPSS, though exploitation requires user interaction and the affected browser is legacy.

What it is

Internet Explorer mishandles objects in memory, producing a memory corruption condition (CWE-119) in the scripting engine. A remote attacker can trigger it to run code with the rights of the current user, which matters because IE shipped by default across a wide range of Windows versions listed in the advisory.

Impact

Successful exploitation gives the attacker the same privileges as the logged-on user, enabling code execution in the browser's context. Because the flaw is memory corruption, a failed attempt can also crash the browser.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically the victim visiting a crafted page or opening attacker-supplied content in Internet Explorer. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.64733 (99.2nd percentile) and a public Exploit-DB entry (43370) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11907.
• Retire or disable Internet Explorer where possible and standardize on a supported browser.
• Enforce Protected Mode and other IE security zones, and block untrusted ActiveX and scripting content.
• Restrict users from browsing untrusted sites and opening unsolicited links or attachments.
• Where IE cannot be removed, keep the OS fully patched and monitor for IE crashes as a possible exploitation signal.

Detection

• Monitor for iexplore.exe crashes and unexpected child processes spawned by Internet Explorer.
• Alert on IE making outbound connections or loading content from newly seen or low-reputation domains.
• Hunt for known Exploit-DB 43370 artifacts and related scripting-engine exploit patterns in proxy and endpoint logs.
• Review endpoint telemetry for process creation where iexplore.exe is the parent of scripting or command interpreters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.