CVE-2017-8759: Microsoft .NET Framework remote code execution via malicious document

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution, is listed in CISA KEV with public exploits, and has a very high EPSS score, though it requires user interaction and a local attack vector.

What it is

Microsoft .NET Framework versions 2.0 through 4.7 contain a code injection flaw that lets an attacker run arbitrary code when a crafted document or application is processed. The record does not name the specific vulnerable component or parsing routine, only that remote code execution is possible. Because .NET Framework is widely deployed and the flaw is listed in CISA KEV, it remains a relevant target for defenders.

Impact

An attacker who gets code to run gains execution in the context of the affected process, with high confidentiality, integrity and availability impact per the CVSS vector. This can lead to full host compromise depending on the privileges of the process handling the document.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), consistent with opening a malicious document or running a crafted application. No authentication is needed, but a user must trigger processing of the malicious file.

Exploitation

CVE-2017-8759 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and has public exploit references, and EPSS shows a 30-day probability of about 0.887 (99.8th percentile). No ransomware campaign use is documented in this record.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) to all affected .NET Framework versions.
• Inventory systems running .NET Framework 2.0 through 4.7 and prioritize patching internet-facing and document-processing hosts.
• Block or restrict execution of untrusted documents and applications on endpoints that process external files.
• Enforce least privilege so document-handling processes do not run with administrative rights.
• Track KEV remediation deadlines and verify patching through vulnerability scanning.

Detection

• Monitor for suspicious child processes spawned by document readers or .NET processes (for example Office or Word launching script interpreters or command shells).
• Alert on outbound network connections from document-processing applications to unusual external hosts.
• Hunt for known public exploit artifacts and payload patterns associated with CVE-2017-8759 in file and process telemetry.
• Audit endpoints for unpatched .NET Framework versions and correlate with document-opening events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.