CVE-2017-11918: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high EPSS and a public exploit reference make this a serious risk for unpatched Edge and ChakraCore users, though it is not in CISA KEV.

What it is

CVE-2017-11918 is a memory corruption flaw in how the ChakraCore scripting engine handles objects in memory, affecting Microsoft Edge and ChakraCore on Windows 10 and Windows Server 2016. Successful exploitation lets an attacker run code with the same rights as the current user, so impact scales with the privileges of the browsing user.

Impact

An attacker gains the same user rights as the current user, which can mean code execution in the browser's security context. If the user is an administrator, the attacker could take control of the affected system.

Attack surface

Reached over the network via a crafted web page or content processed by the scripting engine, requiring user interaction (UI:R) and no prior authentication (PR:N). The CVSS vector notes high attack complexity (AC:H).

Exploitation

An Exploit-DB entry (43469) is referenced, indicating public exploit code exists. The CVE is not listed in CISA KEV, but EPSS is high at 0.62646 (99.15th percentile).

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2017-11918) as the primary fix.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) and Windows Server 2016 systems that cannot be patched.
• Restrict or disable the affected scripting engine where feasible and enforce browser hardening.
• Run users with least privilege so a successful exploit yields limited rights.
• Block known exploit sources and monitor for delivery of crafted web content.

Detection

• Monitor for crashes or abnormal behavior in Microsoft Edge and ChakraCore processes.
• Hunt for known exploit code or indicators tied to Exploit-DB 43469 in web and endpoint telemetry.
• Review proxy and network logs for delivery of crafted pages targeting the scripting engine.
• Track unpatched Windows 10 and Windows Server 2016 assets against the vendor advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.