CVE-2017-11909: Microsoft Chakra Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, though exploitation requires user interaction and high attack complexity and it is not in KEV.

What it is

ChakraCore and the Chakra scripting engine in Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016 mishandle objects in memory, causing a memory corruption condition (CWE-119). An attacker who gets a victim to load crafted content can run code in the context of the current user, which matters because the scripting engine is reachable from normal browsing and document rendering.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the logged-on user. That allows data theft, installation of malware, or further lateral movement on the host.

Attack surface

Reached over the network (AV:N) through crafted script content processed by the Chakra engine, typically in a browser or script host. No privileges are required (PR:N) but user interaction is required (UI:R), and the attack complexity is rated high (AC:H).

Exploitation

A public exploit exists (Exploit-DB 43467), and EPSS is high at 0.6546 (99.2nd percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11909; this is the primary fix.
• Upgrade or remove unsupported Windows 10 builds (1511, 1607, 1703, 1709) and keep Windows Server 2016 patched.
• Keep ChakraCore-based applications updated to a fixed release or migrate off ChakraCore where possible.
• Reduce exposure by restricting browsing to trusted sites and blocking untrusted script content at the network or email gateway.
• Run users with least privilege and enable exploit protection features such as Control Flow Guard and Arbitrary Code Guard where supported.

Detection

• Monitor for crashes or abnormal terminations of browser and script host processes (e.g., Edge, ChakraCore hosts) that could indicate memory corruption attempts.
• Alert on child processes spawned by browsers or script hosts, especially command shells or scripting engines, which may indicate post-exploitation.
• Hunt for known public exploit artifacts tied to Exploit-DB 43467 in web proxy, email, or endpoint logs.
• Track unpatched Windows 10 1511/1607/1703/1709 and Server 2016 hosts via vulnerability or asset inventory scans.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.