CVE-2017-8618 in the critical feed json
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windo…
published 2017-07-11 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17567
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 58.1%
- EPSS 58.1% chance of exploitation in 30 days, percentile 99%
- public exploits
- 1
- Exploit-DB
Summary
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8619, CVE-2017-9598 and CVE-2017-8609.
Patch / fix
Timeline
- Published
- First public exploit (EDB-42337)
Exploit prediction
58.08% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-42337 Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion dos, 2017-07-18
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Corporation Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
portal.msrc.microsoft.com
/en-us/security-guidance/advisory/CVE-2017-8618
patch, vendor-advisory
-
exploit-db.com
/exploits/42337/
exploit, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1038848
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/99399
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-8618
- NVD CVE-2017-8618
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.