CVE-2017-8645: Microsoft Edge scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with high confidentiality, integrity, and availability impact, a public exploit, and very high EPSS, though exploitation requires user interaction.

What it is

Microsoft Edge's JavaScript engine mishandles objects in memory, causing a memory corruption condition (CWE-119) when rendering content. A remote attacker can exploit this to run arbitrary code in the context of the current user. The flaw affects Edge on Windows 10 1511, 1607, 1703, and Windows Server 2016.

Impact

Successful exploitation gives the attacker code execution with the privileges of the logged-in user, enabling data theft, installation of malware, or further host compromise.

Attack surface

Reached over the network via a crafted web page or content rendered by the Edge JavaScript engine; the CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open or view the malicious content.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (42469) exists and EPSS is very high (0.693, 99.3rd percentile), indicating elevated real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8645.
• Upgrade or migrate off unsupported Windows 10 builds (1511, 1607, 1703) to a supported release.
• Restrict or disable Edge where it is not required, and enforce browser hardening.
• Block known malicious sites and untrusted content at the network perimeter.
• Run users with least privilege to limit the impact of code execution.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal child processes spawned from the browser.
• Hunt for exploit artifacts matching Exploit-DB 42469 and related scripting-engine exploit patterns.
• Alert on suspicious process creation chains originating from Edge, such as script interpreters or command shells.
• Review proxy and DNS logs for known exploit-hosting domains tied to this campaign.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.