Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can tamper with data.
Internet Explorer Remote Code Execution Vulnerability
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Until patches are applied, organizations should configure Group Policies to disable Internet Explorer scripting or enforce "Enterprise Mode" to restrict functionality. Implement strict network segmentation and egress filtering to limit potential command-and-control communications from compromised machines. Additionally, educate users to avoid opening untrusted web links and emails, and deploy endpoint detection and response (EDR) solutions for enhanced monitoring.
The permanent resolution involves applying the latest security updates released by Microsoft for affected Internet Explorer versions through Windows Update. These updates address the underlying vulnerability, preventing remote code execution exploits. For environments where Internet Explorer is no longer required, consider disabling or uninstalling it, or transitioning to modern, supported browsers for all web-based activities.
An attacker could exploit this vulnerability to achieve arbitrary code execution on the victim's system with the same privileges as the logged-on user. This allows for complete compromise of the affected machine, potentially leading to data theft, installation of malware, or further lateral movement within the network, causing significant business disruption and reputational damage.
No CWE classification has been assigned.
Other CVEs affecting internet explorer
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
Internet Explorer Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka "Internet Explorer Elevation of Privilege Vulnerability."
Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.