CVE-2017-0149

Deeper analysis

Microsoft Internet Explorer versions 9 through 11 are affected by a memory corruption vulnerability tracked as CVE-2017-0149 and assigned CWE-787. The flaw permits remote attackers to trigger arbitrary code execution or a denial of service condition when a user visits a specially crafted web site. It is distinct from the issues described in CVE-2017-0018 and CVE-2017-0037, and carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low complexity, no required privileges, and required user interaction.

An attacker can host or compromise a web site containing malicious content that exploits the memory corruption when rendered by a vulnerable IE instance. Successful exploitation grants the ability to execute arbitrary code in the context of the current user or to crash the browser, with confidentiality, integrity, and availability impacts all rated high.

Microsoft published an advisory for CVE-2017-0149 through its Security Response Center portal that addresses the issue and provides guidance for affected customers. No information on observed in-the-wild exploitation is supplied in the available references.