⚠ Actively exploited
Added to CISA KEV on 2022-05-24. Federal agencies required to patch by 2022-06-14. Required action: Apply updates per vendor instructions..

CVE-2017-8543 — Improper Preservation of Permissions in Corporation Microsoft Windows

CWE-281 — Improper Preservation of Permissions11 documents9 sources
Severity
9.8CRITICALNVD
EPSS
83.8%
top 0.70%
CISA KEV
KEV
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
15
Microsoft Corporation Microsoft WindowsMicrosoft Windows Server 2008Microsoft Windows Server 2012+12 more
Timeline
PublishedJun 15
KEV addedMay 24
KEV dueJun 14
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages14 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-w5g9-xvwm-4qf8: Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Wi↗2022-05-13
▶
VulnCheck
Microsoft Windows Search Remote Code Execution Vulnerability↗2017
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Search Remote Code Execution Vulnerability↗2022-05-24
▶
Microsoft
Windows Search Remote Code Execution Vulnerability↗2017-06-13
▶

🕵️Threat Intelligence

6
Krebs
Microsoft, Adobe Ship Critical Fixes↗2017-06-13
▶
Talos
Microsoft Patch Tuesday - June 2017↗2017-06-13
▶
Qualys
Microsoft Fixes 94 Security Issues in Massive June Update | Qualys↗2017-06-13
▶
Qualys
Microsoft Fixes 94 Security Issues in Massive June Update↗2017-06-13
▶
Krebs
Microsoft, Adobe Ship Critical Fixes – Krebs on Security↗2017-06-01
▶
CVE-2017-8543 — Improper Preservation of Permissions | cvebase