Vulnerability in Microsoft Corporation Internet Explorer
CVE-2017-0222
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
EPSS: 0.653 (98.5th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Corporation Internet Explorer — versions Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2, Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows 10 Version 1511 for 32-bit Systems, Windows 10 Version 1511 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, Windows 10 Version 1703 for x64-based Systems, and Windows Server 2016.
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222 (x_refsource_CONFIRM)
- 98127 (vdb-entry, x_refsource_BID)
- 1038423 (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-0222?
- CVE-2017-0222 is a vulnerability in Microsoft Corporation Internet Explorer. Published 2017-05-12.
- Is CVE-2017-0222 known to be exploited?
- Yes. CVE-2017-0222 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-02-25), indicating it is being actively exploited. 3 public proof-of-concept repositories are indexed.