CVE-2017-0149KEV · OVERDUE

Microsoft Internet Explorer Memory Corruption Vulnerability

High · published March 17, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

1591
days past CISA
deadline
CVSS v3.1
8.8
EPSS
29%
Percentile
98.2
In the wild
Confirmed
What it is

🚨 A crafted website could compromise your system without a second thought! Internet Explorer versions 9 to 11 are especially vulnerable to this memory corruption issue. 🔥 Think of this vulnerability as a sneaky hacker sneaking into a movie theater and changing the film reel—if unguarded, they can turn a family flick into chaos! An attacker can remotely execute arbitrary code or even cause a denial of service, leading to system crashes or unauthorized actions. This can result in full control over your device, putting your data and security at serious risk!

Put simply

Think of this vulnerability as a sneaky hacker sneaking into a movie theater and changing the film reel—if unguarded, they can turn a family flick into chaos! The vulnerability allows attackers to exploit memory corruption in Internet Explorer, enabling them to execute code on the victim's machine through maliciously crafted web pages.

What to do

An attacker can remotely execute arbitrary code or even cause a denial of service, leading to system crashes or unauthorized actions. This can result in full control over your device, putting your data and security at serious risk! To protect yourself, ensure that you update your Internet Explorer to the latest version or consider migrating to a safer browser. Additionally, implementing web filtering solutions can help block access to harmful sites. 🛡️ You’ve got this! Stay proactive and keep your systems secure! 🚀

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.29178 · 98.2th percentile
Published
2017-03-17T00:00Z
KEV added
2022-05-24 · due 2022-06-14
EPSS history
Timeline
  • 24 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 14
    kev
  • 17 MAR 00:00Z
    Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web…
    cvelistv5