CVE-2017-8738: Buffer Overflow
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8649, CVE-2017-8660, CVE-2017-8729, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8752, CVE-2017-8753, CVE-2017-8755, CVE-2017-8756, and CVE-2017-11764.
Affected Software
Remediation
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this vulnerability?
The attacker must cause a user to interact with malicious content, such as by convincing them to visit attacker-controlled web content in Microsoft Edge. No prior privileges are required, but exploitation has high attack complexity.
Which systems are affected?
Affected systems are Microsoft Edge on Windows 10 Gold, Windows 10 version 1511, Windows 10 version 1607, and Windows Server 2016.
What is the likely impact if exploitation succeeds?
An attacker could execute arbitrary code with the privileges of the current user. The vulnerability is rated high severity and can affect confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available; apply the relevant Microsoft security update for CVE-2017-8738.