Actively exploited · Published May 12, 2017 · Assigned by microsoft
CVE-2017-0222
High 8.8 Exploited
In plain English
A high-severity out-of-bounds write in Internet Explorer from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on February 25, 2022). The chance it is exploited in the next 30 days is estimated at 29.6% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Aug 25, 2022.
Official description
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corporation | Internet Explorer | Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2, Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows 10 Version 1511 for 32-bit Systems, Windows 10 Version 1511 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, Windows 10 Version 1703 for x64-based Systems, and Windows Server 2016. |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222 x_refsource_CONFIRM
- 98127 vdb-entry, x_refsource_BID
- 1038423 vdb-entry, x_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0222 government-resource