CVE-2017-11911: Microsoft Scripting Engine Memory Corruption in ChakraCore and Edge

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityA public exploit exists and EPSS is very high, but exploitation requires user interaction and the flaw is not in CISA KEV.

What it is

CVE-2017-11911 is a memory corruption flaw in how the Microsoft scripting engine handles objects in memory, affecting ChakraCore and the Edge browser on Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016. Successful exploitation lets an attacker run arbitrary code in the context of the current user, so the impact is bounded by that user's privileges.

Impact

An attacker gains arbitrary code execution as the logged-in user, which can lead to data theft, installation of malware, or full account compromise if the user has administrative rights.

Attack surface

Reached over the network via a crafted web page or script that the scripting engine processes; the CVSS vector shows no privileges required but user interaction required, meaning the victim must open or view the malicious content.

Exploitation

A public exploit exists on Exploit-DB, and EPSS is 0.6546 (99.2nd percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for the affected Windows and ChakraCore versions.
• Upgrade or replace unsupported Windows 10 builds (1511, 1607, 1703, 1709) that no longer receive security fixes.
• Restrict or disable unnecessary scripting engine and browser components where operationally feasible.
• Enforce browser isolation or application allowlisting to reduce exposure to malicious web content.
• Educate users not to open untrusted links or attachments that could deliver crafted script content.

Detection

• Monitor for browser or scripting engine crashes, especially repeated faults in Edge or ChakraCore processes.
• Hunt for suspicious child processes spawned by browser processes, which can indicate successful exploitation.
• Review proxy and DNS logs for known exploit-hosting domains or delivery of malicious script content.
• Correlate endpoint telemetry for memory corruption indicators and unusual code execution in user context.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.