CVE-2017-8740: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 High with a public exploit and very high EPSS percentile, though exploitation requires user interaction and the affected platform is dated.

What it is

Microsoft Edge on Windows 10 version 1703 mishandles objects in memory in its scripting engine, a memory corruption flaw classified as CWE-119. Successful exploitation lets an attacker run arbitrary code in the context of the current user, and the record notes this CVE is distinct from a long list of related scripting engine CVEs patched in the same cycle.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, which can lead to full compromise of the user's data and, depending on that user's rights, the host. The CVSS 3.0 vector rates confidentiality, integrity and availability impact all High.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) but requires user interaction (UI:R), consistent with a victim visiting a crafted or compromised web page in Edge. No authentication is needed on the attacker's side; the victim must be lured into loading the malicious content.

Exploitation

CISA KEV does not list this CVE, but a public Exploit-DB entry (42764) exists and EPSS gives a 30-day probability of 0.72171 (99.4th percentile), indicating high predicted exploitation activity. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8740 as the first action.
• Upgrade or migrate off Windows 10 version 1703 and legacy Edge, which are no longer supported.
• Enforce a modern, fully patched browser as the default and block or restrict legacy Edge where feasible.
• Reduce exposure through network and email filtering of known exploit and malicious-page infrastructure, and user awareness training against lure links.

Detection

• Hunt for Edge (MicrosoftEdge.exe) crashes or abnormal child-process creation, especially browser processes spawning script interpreters or command shells.
• Monitor for exploit artifacts tied to Exploit-DB 42764 and related public PoCs in proxy, IDS/IPS and endpoint telemetry.
• Alert on suspicious outbound connections or payload downloads immediately following Edge page loads from untrusted or newly registered domains.
• Review endpoint logs for memory-corruption indicators such as repeated renderer crashes on the same host or user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.