Endpoint Vulnerability

Scripting Engine Memory Corruption Vulnerability

Description

A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the Internet Explorer rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit this vulnerability.

Affected Products

Internet Explorer 11,Windows 10,Windows 7,Windows 8,Windows Server 2008,Windows Server 2012,Windows Server 2016

References

CVE-2017-8618,