CVE-2017-0037

CVE-2017-0037 is a type confusion flaw (CWE-843) in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, located in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function of mshtml.dll. It is triggered when the browser processes a crafted Cascading Style Sheets token sequence combined with JavaScript that operates on a TH (table header) element, typically delivered via a malicious or compromised web page. An attacker who successfully exploits it can execute arbitrary code in the context of the browser process. Any user running the affected legacy Microsoft browsers is exposed, which historically meant most Windows desktops. The flaw was publicly disclosed via Google Project Zero after a 90-day deadline passed, public proof-of-concept exploits are available, and it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), confirming in-the-wild exploitation.

What to do: Apply Microsoft security updates per vendor instructions (the flaw was addressed in Microsoft's March 2017 Patch Tuesday, which followed the Project Zero disclosure), prioritizing systems in CISA KEV scope. Inventory for any hosts still running IE 10/11 or legacy (pre-Chromium) Edge and retire or isolate them, as legacy Microsoft browsers are end-of-life. As an interim mitigation, avoid using affected browsers for untrusted web content, since exploitation requires rendering attacker-crafted CSS/JavaScript.