CVE-2017-0022: Microsoft XML Core Services Information Disclosure Vulnerability
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."
Other sources
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What are the potential impacts of CVE-2017-0022?
CVE-2017-0022 could allow attackers to execute arbitrary code in the context of the current user.
How can I determine if my system is affected by CVE-2017-0022?
You can check if your system is affected by CVE-2017-0022 by verifying if you are running vulnerable versions of Microsoft XML Core Services on supported Windows versions.
What remediation steps should be taken for CVE-2017-0022?
To fix CVE-2017-0022, ensure that you install the latest security updates provided by Microsoft that address this vulnerability.
What versions of Microsoft Windows are impacted by CVE-2017-0022?
CVE-2017-0022 affects multiple Windows versions including Windows 7 SP1, Windows 8.1, and various Windows Server editions.
Is there a workaround for CVE-2017-0022 while waiting for a patch?
While there is no formal workaround for CVE-2017-0022, best practice is to minimize user privileges and avoid opening untrusted files or links until a patch is applied.