CVE-2017-8646: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with a public exploit and very high EPSS, though exploitation requires user interaction and no KEV listing exists.

What it is

Microsoft Edge on Windows 10 (1511, 1607, 1703) and Windows Server 2016 mishandles objects in memory in its JavaScript engine, causing a memory corruption condition (CWE-119). A remote attacker can exploit this to run arbitrary code in the context of the current user, so the flaw matters wherever Edge is used to browse untrusted content.

Impact

Successful exploitation gives the attacker code execution with the privileges of the logged-in user, enabling data theft, installation of malware, or further host compromise. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through crafted web content rendered by the Edge JavaScript engine; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must open or view the malicious page.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.69277, 99.3rd percentile) and a public Exploit-DB entry (42470) exists, indicating exploit code is available. No ransomware group use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8646 as the first action.
• Upgrade or migrate off the affected Windows 10 builds (1511, 1607, 1703) and Windows Server 2016 Edge configurations where feasible.
• Enforce browser hardening such as Enhanced Mitigation Experience Toolkit or Windows Defender Exploit Guard mitigations for Edge.
• Restrict browsing of untrusted sites and block known malicious domains at the network or proxy layer.
• Reduce reliance on Edge for high-risk web use until patching is verified across the estate.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal process terminations that may indicate memory corruption attempts.
• Hunt for child processes spawned by Edge, such as script interpreters or command shells, which are atypical for normal browsing.
• Review proxy and DNS logs for access to domains associated with the public Exploit-DB proof-of-concept.
• Correlate endpoint telemetry for suspicious memory allocation or write patterns in Edge processes on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.