Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-8598: Microsoft Edge on Windows 10/Server can run malicious code

CVE-2017-8598 · published 9 years ago

Summary

The web browser Microsoft Edge in certain versions of Windows 10 and Windows Server can be tricked into running code that an attacker supplies. If a user visits a specially crafted web page, the attacker could execute actions with the same rights as the logged‑in user, such as installing software or accessing files. Apply the latest Windows and Edge updates as soon as they are available to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	edge	All versions `cpe:2.3:a:microsoft:edge::::::::`

Original advisory text

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8595, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609.

References

http://www.securityfocus.com/bid/99417 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038849 Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8598 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Exploitation

9% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published11 Jul 2017

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-8598 · NVD

Track software like this

Free during beta