CVE-2017-8636: Microsoft browser JavaScript engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit code and a very high EPSS score make this readily weaponizable, though the CVSS attack complexity is high and user interaction is required.

What it is

Microsoft Internet Explorer and Edge JavaScript engines mishandle objects in memory when rendering content, a memory corruption flaw (CWE-119) that lets an attacker execute arbitrary code in the context of the current user. It affects a broad set of Windows client and server releases, and public exploit code exists, so unpatched browser users are at real risk.

Impact

An attacker who triggers the flaw gains arbitrary code execution with the privileges of the logged-in user, which can lead to full system compromise if that user has administrative rights.

Attack surface

Reached over the network via a crafted web page or content that the browser's JavaScript engine renders; the CVSS vector requires user interaction (UI:R) and no authentication (PR:N), so a victim must visit or open attacker-controlled content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.721, 99.4th percentile) and multiple Exploit-DB entries are tagged as exploits, indicating public exploit code is available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8636 as the first action.
• Upgrade or retire unsupported platforms (Windows 7 SP1, Windows 8.1, Windows RT 8.1, Server 2008 R2, Server 2012/R2) that no longer receive browser fixes.
• Enforce use of a current, fully patched browser and disable legacy Internet Explorer where business needs allow.
• Reduce exposure by blocking untrusted web content and restricting high-risk browsing through network or proxy controls.

Detection

• Hunt for browser processes (iexplore.exe, MicrosoftEdge.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts, which is abnormal for normal browsing.
• Monitor for crashes or exploit artifacts in the JavaScript engine, including repeated browser process terminations tied to the same user or URL.
• Review proxy and web logs for known exploit-hosting domains or pages delivering the Exploit-DB payloads associated with this CVE.
• Alert on suspicious memory-protection changes or shellcode-like behavior in browser process memory where endpoint telemetry supports it.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.