Actively exploited · Published Mar 17, 2017 · Assigned by microsoft

CVE-2017-0149

High 8.8 Exploited

In plain English

A high-severity out-of-bounds write in Internet Explorer from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). The chance it is exploited in the next 30 days is estimated at 28.5% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)28.5%top 1.9% of all CVEs

Exploited in the wildYesCISA KEV since May 24, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 14, 2022.

Official description

Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.

Affected products (as reported)

Vendor	Product	Versions
Microsoft Corporation	Internet Explorer	Internet Explorer 9 through 11

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0149 x_refsource_CONFIRM
96724 vdb-entry, x_refsource_BID
1038008 vdb-entry, x_refsource_SECTRACK
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0149 government-resource