Vulnerability record · CVE-2017-8601 · published 11 July 2017
CVE-2017-8601: Microsoft Edge scripting engine memory corruption allows code execution
Microsoft · Edge
Microsoft Edge's JavaScript engine mishandles objects in memory, causing a memory corruption condition (CWE-119) when rendering. A remote attacker can exploit this to run arbitrary code in the context of the current user. It affects Edge on Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016.
Description
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8598 and CVE-2017-8609.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.5 with a public exploit and very high EPSS make this a realistic remote code execution risk despite the required user interaction.
What it is
Microsoft Edge's JavaScript engine mishandles objects in memory, causing a memory corruption condition (CWE-119) when rendering. A remote attacker can exploit this to run arbitrary code in the context of the current user. It affects Edge on Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016.
Impact
An attacker who convinces a user to open a crafted page gains arbitrary code execution with the privileges of the logged-in user, enabling data theft, persistence, or further compromise of the host.
Attack surface
Reached over the network through a malicious or compromised web page rendered in Microsoft Edge; no authentication is required, but user interaction (visiting the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.
Exploitation
Not listed in CISA KEV, but a public Exploit-DB entry (42479) exists and EPSS is high at 0.669 (99.3rd percentile), indicating meaningful real-world exploitation likelihood.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8601 on all affected Windows 10 and Windows Server 2016 systems.
- Prioritize patching internet-facing and user-workstation endpoints running Microsoft Edge.
- Restrict or block untrusted web content and enforce browser hardening where Edge cannot be immediately patched.
- Retire unsupported Windows 10 builds (Gold, 1511, 1607, 1703) that no longer receive security fixes.
Detection
- Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal child process creation following web browsing.
- Hunt for post-exploitation behavior such as unexpected script or command interpreters spawned by the browser.
- Review proxy and DNS logs for known exploit-hosting domains tied to public Edge exploit code.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/99420 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038849 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8601 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42479/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/99420 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038849 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8601 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/42479/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2017-8601 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-8601), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
