CVE-2017-0022

Deeper analysis

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 contains an information disclosure vulnerability. The component improperly handles objects in memory, which can be leveraged to reveal the presence of arbitrary files on disk. The issue is tracked as CWE-119 with a CVSS 3.1 base score of 6.5 reflecting network attack vector, low complexity, and high confidentiality impact.

An unauthenticated remote attacker can exploit the flaw by convincing a user to visit a specially crafted web site under the attacker's control. Successful exploitation allows the attacker to test for the existence of files on the victim's local disk without requiring additional privileges or user interaction beyond visiting the page, resulting in targeted information disclosure.

The Microsoft Security Response Center advisory for CVE-2017-0022 provides official guidance on available patches and mitigations for the listed Windows versions. A related security blog post documents the vulnerability's incorporation into exploit kit activity, confirming real-world use for file-existence probing in the wild.