Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Microsoft Edge may let attackers run code

CVE-2017-0132 · published 9 years ago
Summary

Microsoft Edge can be tricked into mishandling data in its scripting engine, which could let a remote attacker run whatever code they choose. If a user is logged in with administrative rights, the attacker could take control of the system, install software, modify data, or create new user accounts. Apply the latest Microsoft Edge updates as soon as possible to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft edge All versions
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
Original advisory text
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory...
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.5 High
Exploitation
15% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published17 Mar 2017
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-0132 · NVD
Track software like this
Free during beta