What’s Vulnerable › Vulnerabilities

CVE-2017-0028

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-07-17 · updated 2026-06-17
• Weakness: CWE-119

Description

A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."

Affected products

• Microsoft Edge: all versions

References

• https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724
• https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724

Get alerted when CVE-2017-0028 or the next vulnerability affects your stack