CVE-2017-8657: Microsoft Edge scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a widely deployed browser with a public exploit reference and very high EPSS score, though exploitation requires user interaction and no KEV listing exists.

What it is

Microsoft Edge's JavaScript engine mishandles objects in memory when rendering content, causing a memory corruption condition (CWE-119). A remote attacker can trigger it to run arbitrary code in the context of the current user. It affects Edge on Windows 10 1511, 1607, 1703, and Windows Server 2016.

Impact

Successful exploitation gives the attacker code execution with the privileges of the logged-in user, enabling data theft, further compromise of the host, or installation of malware. The CVSS 3.0 vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reached over the network (AV:N) through crafted web content rendered by the Edge JavaScript engine. No privileges are required (PR:N) but a user must interact, typically by visiting a malicious or compromised page (UI:R).

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but an Exploit-DB entry (42481) exists and EPSS is 0.54558 (98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8657 as the first action.
• Upgrade or migrate off the affected Windows 10 builds (1511, 1607, 1703) and Windows Server 2016 to supported, patched releases.
• Enforce browser hardening: block untrusted script sources, keep Edge/WebView2 current, and restrict browsing to trusted sites.
• Reduce impact by running users without local administrator rights and applying exploit protection (e.g., ACG, CIG) where feasible.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal child processes spawning from the browser, which can indicate memory corruption exploitation.
• Alert on suspicious script or document downloads and subsequent process creation originating from Edge sessions.
• Hunt for known exploit artifacts tied to Exploit-DB 42481 in web proxy, endpoint, or EDR telemetry.
• Track unpatched Edge/Windows 10 1511/1607/1703 and Server 2016 hosts via vulnerability scanning and asset inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.