CVE-2017-11914: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with public exploit code and very high EPSS, but exploitation requires user interaction and no KEV listing confirms active campaigns.

What it is

CVE-2017-11914 is a memory corruption flaw in how the ChakraCore scripting engine handles objects in memory, affecting Microsoft Edge and ChakraCore on Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016. Successful exploitation lets an attacker run code with the same rights as the current user, so the impact scales with the privileges of whoever is browsing.

Impact

An attacker gains code execution at the privilege level of the logged-in user, which can mean full control of the account's data and, on admin sessions, the host. No elevation beyond the current user is described.

Attack surface

Reached over the network through a crafted web page or script processed by the Edge/ChakraCore scripting engine, per the AV:N vector. The CVSS vector requires user interaction (UI:R) and no authentication (PR:N), so a victim must open or be directed to malicious content.

Exploitation

An Exploit-DB entry (EDB-43713) is referenced, indicating public exploit code exists, and EPSS is high at 0.626 (99th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the Microsoft security update for CVE-2017-11914 (MSRC advisory) to Edge, ChakraCore and affected Windows 10/Server 2016 builds first.
• Keep Windows and Edge fully patched; these 2017 builds are long out of support, so migrate off Windows 10 1511/1607/1703/1709 and Server 2016 where feasible.
• Restrict or disable ChakraCore-based scripting where it is not required by business applications.
• Enforce browsing controls and block untrusted sites to reduce exposure to crafted pages that trigger the flaw.
• Run users with least privilege so code execution stays confined to a standard account.

Detection

• Monitor for Edge or ChakraCore process crashes and unexpected child processes spawned from browser processes.
• Alert on suspicious script or document content delivered from newly seen or low-reputation domains to Edge users.
• Hunt for post-exploitation behavior from browser processes, such as unusual outbound connections or dropped executables.
• Track endpoint telemetry for known exploit artifacts tied to EDB-43713 in browser memory or script execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.