CVE-2017-11861 is a scripting engine memory corruption vulnerability in Microsoft Edge affecting Windows 10 (versions 1607, 1703, 1709) and Windows Server (2016, version 1709). This flaw allows an attacker to execute arbitrary code with the same user rights as the current user. The vulnerability has a CVSS v3 score of 7.5 (HIGH), indicating a network-based attack with high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity. While not listed in CISA's KEV catalog, an exploit for this vulnerability (EDB-43153) exists in ExploitDB, and it has a high EPSS score of 0.76161, suggesting a significant likelihood of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.