CVE-2017-8543

CVE-2017-8543 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the Windows Search service, which fails to properly handle objects in memory. A remote attacker can trigger it by sending specially crafted messages to the Windows Search service over SMB, or by convincing a user to open a specially crafted file, with no credentials or user interaction required in the network scenario. Successful exploitation gives the attacker complete control of the affected system, including the ability to install programs and to view, change, or delete data. Essentially every Windows client and server release of the era is affected, from Windows XP SP3 and Server 2003 through Windows 10 1703 and Server 2016. The flaw has been exploited in the wild: Microsoft patched it in the June 2017 Patch Tuesday release with reports of active attacks, CISA added it to the KEV catalog on 2022-05-24, and EPSS assigns a 74.3% probability of exploitation within 30 days (99th percentile).

What to do: Install the June 2017 Microsoft security updates (or any later Monthly Quality Rollup) on all affected Windows clients and servers, prioritizing systems with SMB exposed to the internet, which also closes the CISA KEV required action. As an interim mitigation, disabling the Windows Search (WSearch) service blocks exploitation. Inventory for and patch legacy hosts running XP, Server 2003, or Server 2008/2012, which are least likely to have received the fix.