CVE-2017-0149

A memory corruption flaw (CWE-119) in Microsoft Internet Explorer mishandles memory when the browser processes web content. An attacker triggers it by luring a user to a specially crafted website, corrupting browser memory in a way that permits remote code execution in the context of the current user or a crash (denial of service). Successful exploitation gives the attacker code execution under the victim's privileges, yielding a foothold in the user's environment, including elevated access if an administrator is browsing. Internet Explorer versions 9 through 11 (per vendor advisory) are affected, with residual exposure concentrated in legacy Windows 7/8.x and Windows Server estates and in the IE11 component still present on Windows 10. The flaw is confirmed exploited in the wild, having been added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-24, and EPSS estimates a ~29% probability of exploitation within 30 days (98th percentile); no public PoC is known.

What to do: Install Microsoft's cumulative security update for Internet Explorer (the fix shipped in the March 2017 Patch Tuesday cumulative IE updates) on legacy Windows 7/8.x/Server hosts, and ensure Windows 10 devices are fully current via cumulative Windows updates. Inventory for legacy Windows machines and servers with unpatched IE, and prioritize migration to Microsoft Edge (using IE Mode only where required) since IE11 is retired. Where IE must remain in use, harden it with attack surface reduction rules and discourage or restrict browsing of untrusted sites in IE.