Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-0133: Microsoft Edge can run malicious code remotely
CVE-2017-0133 · published 9 years ago
Summary
Microsoft Edge’s scripting engine can be tricked into running harmful code when it processes certain web content. If exploited, an attacker could take the same actions as the logged‑in user, including installing software or accessing data. Apply the latest Microsoft Edge updates to protect your systems.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | edge |
All versions
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* |
Original advisory text
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory...
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.
References
- http://www.securityfocus.com/bid/96683 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1038006
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0133 Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published17 Mar 2017
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2017-0133 · NVD
Track software like this
Free during beta