CVE-2017-0222highunder attackCWE-787

CVE-2017-0222: high-severity vulnerability in Microsoft Corporation Internet Explorer

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 30%
from disclosure to weapon
Published on NVDMay 12
CISA KEV+1750d
Action required by CISAfederal deadline: 2022-08-25

Apply updates per vendor instructions.

In short

Internet Explorer has a memory corruption flaw that allows attackers to run malicious code on your computer when you visit a specially crafted website. This happens because the browser doesn't properly manage memory, giving attackers a way to take control.

Technical detail

A memory corruption vulnerability in Internet Explorer's object access mechanism allows remote code execution via specially crafted web content. The attack requires user interaction (visiting a malicious site) and exploits improper memory handling to achieve arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Internet Explorer
Related CVEs — Microsoft Corporation Internet Explorer

In the same product, most dangerous first.

CVE-2017-0059MEDIUMCVE-2017-0059EPSS 62.0%KEVCVE-2017-0149HIGHCVE-2017-0149EPSS 28.5%KEVCVE-2017-0210HIGHCVE-2017-0210EPSS 22.3%KEVCVE-2017-11907—CVE-2017-11907EPSS 64.7%CVE-2018-0935—CVE-2018-0935EPSS 55.6%CVE-2017-11810—CVE-2017-11810EPSS 54.8%