CVE-2017-8731: Microsoft Edge memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 3.0 is 7.5 (HIGH), a public exploit exists, and EPSS is near the top percentile, though exploitation requires user interaction and no KEV listing is present.

What it is

Microsoft Edge on Windows 10 1607 and Windows Server 2016 mishandles objects in memory, producing a memory corruption condition (CWE-119). A remote attacker can trigger it through crafted content and run code as the current user, so the flaw matters wherever Edge is used for browsing or rendering untrusted web content.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the logged-in user, with high confidentiality, integrity and availability impact. The attacker does not gain system privileges directly but inherits the user's data and permissions.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R), meaning the victim must open or view attacker-controlled content in Edge. No authentication is needed on the target.

Exploitation

CISA KEV does not list this CVE, but a public Exploit-DB entry (42758) exists and EPSS is high at roughly 0.516 (98.9th percentile), indicating meaningful exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8731.
• Upgrade or migrate off Windows 10 1607 and Windows Server 2016 Edge builds that are no longer serviced.
• Enforce browsing in a modern, fully patched browser and block legacy Edge where feasible.
• Reduce exposure by restricting untrusted web content and applying network filtering for known malicious hosts.
• Run browsing sessions with least privilege and enable exploit mitigations such as ASLR and DEP.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal terminations that may indicate memory corruption attempts.
• Hunt for child processes spawned by Edge, such as script interpreters or command shells, which are atypical for normal browsing.
• Review proxy and DNS logs for connections to hosts associated with known exploit pages or malvertising.
• Correlate endpoint telemetry for suspicious memory writes or code execution originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.