CVE-2017-8548: Microsoft Edge Scripting Engine Memory Corruption Flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, a public exploit reference, and very high EPSS despite no KEV listing.

What it is

Microsoft Edge mishandles objects in memory, producing a scripting engine memory corruption condition (CWE-119). The flaw is reachable over the network but requires a user to interact with a crafted page, and it can leak information usable for further compromise of the system.

Impact

An attacker who gets a victim to load malicious content can obtain information from the browser process that aids follow-on exploitation. The CVSS vector rates confidentiality, integrity and availability impact as high, so the outcome can extend beyond simple disclosure.

Attack surface

Reached over the network through the Edge scripting engine, with no privileges required but user interaction required (UI:R) per the CVSS vector. The description does not specify the exact trigger, only that Edge improperly handles objects in memory.

Exploitation

Not listed in CISA KEV, but EPSS is 0.67587 (99.277th percentile) and a public Exploit-DB entry (42473) is referenced, indicating exploit code exists and exploitation is plausible.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8548.
• Upgrade or migrate off the affected Windows 10 builds (Gold, 1511, 1607, 1703) and Windows Server 2016 where Edge is in use.
• Enforce browser hardening: block untrusted script sources, restrict plug-ins, and keep Edge/WebView2 patched.
• Reduce exposure by limiting browsing to trusted sites and using network controls to block known malicious hosts.
• Monitor for and remove unsupported or unpatched Edge installations on managed endpoints.

Detection

• Hunt for Edge process crashes or abnormal terminations that may indicate memory corruption attempts.
• Monitor for known Exploit-DB 42473 indicators and related exploit traffic in web proxy or IDS logs.
• Correlate suspicious script or HTML delivery to Edge user agents with subsequent process injection or credential access events.
• Track patch status of Edge and Windows 10 builds listed as affected to find unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.