CVE-2017-8670: Microsoft Edge JavaScript engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution in a widely used browser with public exploit code and very high EPSS, though exploitation requires user interaction and the affected builds are dated.

What it is

Microsoft Edge on Windows 10 1607, 1703 and Windows Server 2016 mishandles objects in memory in its JavaScript engine, causing a memory corruption condition. A remote attacker who gets a user to load crafted content can run arbitrary code in the context of the current user.

Impact

Successful exploitation gives the attacker code execution with the privileges of the logged-in user, enabling data theft, installation of malware, or further compromise of the host.

Attack surface

Reached over the network through the browser rendering crafted content; the CVSS vector shows no privileges required but user interaction is required, so the victim must open or view attacker-controlled content in Edge.

Exploitation

Not listed in CISA KEV, but EPSS is 0.68729 (99.3rd percentile) and a public Exploit-DB entry (42477) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8670.
• Upgrade or migrate off unsupported Windows 10 1607/1703 builds and keep Edge and Windows fully patched.
• Restrict browsing to trusted sites and block untrusted web content where feasible.
• Run users with least privilege and enable exploit protection features such as Control Flow Guard and ACG where supported.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal process terminations that may indicate memory corruption attempts.
• Hunt for child processes spawned by Edge, especially script interpreters or command shells, which are unusual for normal browsing.
• Review proxy and DNS logs for access to known exploit-hosting or malicious sites delivering browser exploit content.
• Correlate endpoint telemetry for suspicious memory allocation or code injection activity originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.