CVE-2017-8671: Microsoft Edge scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with public exploit code and very high EPSS, though it requires user interaction and affects older Windows builds.

What it is

Microsoft Edge's JavaScript engine mishandles objects in memory, causing a memory corruption condition (CWE-119) that can be triggered by crafted content. It affects Edge on Windows 10 1511, 1607, 1703, and Windows Server 2016, and is one of a large batch of similar scripting engine flaws patched together. Because the browser runs with user privileges, successful exploitation gives code execution in that user's context.

Impact

An attacker can execute arbitrary code in the context of the current user, potentially leading to full compromise of the browsing session and any data or credentials that user can reach.

Attack surface

Reached over the network through the browser rendering crafted JavaScript content; the CVSS vector shows no privileges required but user interaction required, meaning the victim must open or view the malicious page.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.693, 99.3rd percentile) and a public Exploit-DB entry (42475) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8671.
• Upgrade or migrate off unsupported Windows 10 builds (1511, 1607, 1703) and keep Edge and Windows fully patched.
• Enforce browser hardening: disable or restrict JavaScript where feasible and block untrusted sites via proxy or filtering.
• Reduce impact by running users without local admin rights and enabling exploit protection features such as Control Flow Guard and Arbitrary Code Guard.
• Monitor vendor advisories for the related scripting engine CVEs patched in the same cycle and ensure all are applied.

Detection

• Hunt for Edge (MicrosoftEdge.exe) crashes or abnormal terminations on endpoints, especially correlated with recent browsing to untrusted sites.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains around the time of browser crashes.
• Monitor for suspicious child processes spawned by MicrosoftEdge.exe, such as script interpreters or command shells.
• Use EDR to alert on memory corruption indicators or exploit-mitigation events (for example, CFG or ACG violations) in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.