CVE-2017-8634: Microsoft Edge scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in a browser with public exploit code and very high EPSS, though it requires user interaction and affects an outdated platform.

What it is

Microsoft Edge on Windows 10 1703 mishandles objects in memory in its JavaScript engine, causing a memory corruption condition (CWE-119). A remote attacker can trigger it through crafted content and run code as the current user. It is one of a large batch of similar scripting engine flaws patched together in August 2017.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the logged-in user, with the same rights as that user. Because the flaw is in the browser, the attacker could read data, install software or pivot further depending on user privileges.

Attack surface

Reached over the network via a crafted web page or content rendered by the Edge JavaScript engine. The CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open or interact with the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.7028 (99.35th percentile) and a public Exploit-DB entry (42474) exists, indicating exploit code is available. No ransomware association is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8634.
• Upgrade or migrate off Windows 10 1703 and legacy Edge, which are out of support.
• Enforce browser hardening: block untrusted script sources and restrict high-risk web content via policy.
• Run users with least privilege so code execution does not yield administrative rights.
• Keep endpoint protection and browser exploit mitigations enabled and current.

Detection

• Monitor for Edge crashes or abnormal renderer process terminations that may indicate memory corruption attempts.
• Hunt for exploit artifacts matching Exploit-DB 42474 and related scripting engine PoCs in proxy or endpoint logs.
• Alert on suspicious child processes spawned by Edge (e.g., script interpreters, LOLBins).
• Track access to known malicious or exploit-hosting domains in web proxy and DNS logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.