CVE-2017-0022

Microsoft XML Core Services (MSXML) on supported Windows client and server releases improperly handles objects in memory, allowing a remote attacker to test whether specific files exist on a victim's disk. The flaw is triggered when a user is lured to a crafted website (user interaction is required), typically via browser-delivered web content rather than through a network service. A successful attacker gains only information about file presence on disk, which is useful for reconnaissance in follow-on attacks but does not directly enable code execution. Essentially every Windows version of that era is affected, from Vista SP2 through Windows 10 1607 and Windows Server 2016, so the affected population is the broad Windows installed base at the time. The vulnerability is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-24) and public analysis documents its use by exploit kits, so in-the-wild exploitation is confirmed.

What to do: Apply Microsoft's security updates across all affected Windows releases as CISA's KEV required action specifies, prioritizing end-user workstations and multi-user systems where web browsing occurs. For legacy systems that no longer receive patches (Vista SP2, Server 2008), upgrade, restrict users from untrusted web content, or consider micro-patching; when auditing older images, verify the MSXML update is installed.