CVE-2017-8641: Microsoft browser scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution in widely deployed browsers with public exploit code and very high EPSS, though exploitation requires the victim to open a crafted page.

What it is

Microsoft Edge and Internet Explorer JavaScript engines mishandle objects in memory, producing a memory corruption condition (CWE-119) that can be triggered while rendering content. Because the flaw sits in the scripting engine, a crafted page can corrupt memory in the browser process and run code as the logged-in user. It affects a broad set of Windows client and server releases listed in the advisory.

Impact

An attacker who lands the exploit executes arbitrary code in the context of the current user, giving the same rights as that user over the affected system. On a browsing account this can mean data theft, credential access and further lateral movement.

Attack surface

Reached over the network through a browser rendering a malicious or compromised web page; the CVSS vector shows no privileges required but user interaction required, so the victim must open the page. No authentication is needed to deliver the content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.716 probability, 99.4th percentile) and a public Exploit-DB entry (42465) exists, so working exploit code is publicly available. No ransomware association is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8641 on all affected Windows versions.
• If patching cannot be immediate, restrict or disable legacy Internet Explorer and unpatched Edge usage, and block untrusted script execution where policy allows.
• Keep browsers and the OS on supported builds; the affected Windows 10 and Server versions are long out of support, so migrate off them.
• Enforce least privilege on browsing accounts and block known exploit-hosting domains at the web gateway.
• Use application control or browser isolation to contain rendering of untrusted web content.

Detection

• Monitor for browser processes (iexplore.exe, MicrosoftEdge.exe) spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Alert on browser crashes or memory-corruption events in JavaScript engine modules across endpoints.
• Hunt proxy and DNS logs for requests to domains tied to known exploit kits or the Exploit-DB 42465 payload.
• Correlate endpoint telemetry for unusual outbound connections originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.