Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R…

published 2017-05-12 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-0579

cvss: 7.3; version 3.1, CNA
cisa kev: Exploited; added 2022-03-28, used in ransomware
epss: 84.3%; EPSS 84.3% chance of exploitation in 30 days, percentile 99.6%
public exploits: 1; Exploit-DB

Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

Patch / fix

cisa required action Apply updates per vendor instructions.

links 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213 advisory

Timeline

2017-05-12 Published
2017-05-17 First public exploit (EDB-42020)
2022-03-28 Added to CISA KEV
2022-04-18 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-28)
Patch by: 2022-04-18 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Windows
CISA name: Microsoft Windows Privilege Escalation Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

RagnarLocker ransomware gang

reported by web.archive.org

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

84.26% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-42020 Microsoft Windows - COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation local, 2017-05-17

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	1.9	AV:L/AC:M/Au:N/C:N/I:P/A:N

Affected products

Microsoft Corporation Windows COM

References

portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-0213
patch, vendor-advisory
exploit-db.com /exploits/42020/
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/98102
vdb-entry, broken-link, third-party-advisory
securitytracker.com /id/1038457
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0213
government-resource, us-government-resource

Sources

CVE List CVE-2017-0213
NVD CVE-2017-0213

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary