CVE-2017-8755: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with public exploit code and very high EPSS, though exploitation requires user interaction and the affected Windows builds are old.

What it is

Microsoft Edge mishandles objects in memory in its scripting engine, producing a memory corruption condition (CWE-119). An attacker who gets a user to load crafted content in Edge can run code in that user's context, which matters because the browser runs with the user's privileges and the flaw affects Windows 10 1511, 1607, 1703 and Windows Server 2016.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the current user. Depending on that user's rights, the attacker could read or modify data, install software, or pivot further into the host.

Attack surface

Reached over the network through the Edge scripting engine, but the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), meaning the victim must open or view attacker-supplied content in Edge. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.71272, 99.4th percentile) and a public Exploit-DB entry (42766) exists, so working exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8755 on all affected Windows 10 and Windows Server 2016 systems.
• Upgrade or migrate off the affected Windows 10 builds (1511, 1607, 1703) where feasible, since they are long out of support.
• Enforce browser hardening: block untrusted sites, restrict script execution where possible, and keep Edge and its dependencies current.
• Reduce impact by running users without local administrator rights and applying exploit protection features to browser processes.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes or abnormal child processes spawned from the browser, which can indicate scripting engine exploitation.
• Hunt for suspicious processes or network connections originating from Edge, especially those writing to user-writable directories or launching command interpreters.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains delivering Edge-targeted exploit pages.
• Correlate endpoint telemetry for memory corruption indicators in scripting engine modules with subsequent process creation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.