cbcvebase.
CVE-2017-8656
published 2017-08-08

CVE-2017-8656: Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due…

PriorityP269high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
69.28%
99.3th percentile
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.

Affected

9 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
microsoft_corporationmicrosoft_scripting_engine
msrcmicrosoft_edge_on_windows_10_version_1607_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_server_2016

Detection & IOCsextracted from sources · hover to see the quote

  • Trigger condition: JavaScript catch block using destructuring pattern parameter (knopParamPattern) combined with a var declaration of the same name inside the catch block — exploits missing SetIsCatch() call in Chakra's PreVisitCatch, causing uninitialized stack value reference.
  • Vulnerable component is Microsoft Edge's Chakra JavaScript engine PreVisitCatch function — look for Edge processes (MicrosoftEdge.exe / chakra.dll) crashing or behaving anomalously when processing pages with try/catch destructuring patterns.
  • Attack vector is web-based: attacker hosts a specially crafted website or embeds an ActiveX control marked 'safe for initialization' in an Office document to trigger the vulnerability via Microsoft browsers.
  • ·Exploit status at time of patching: publicly disclosed but not yet observed exploited in the wild; exploitation assessed as 'More Likely' for latest software release.
  • ·Patch KB4034674 and KB4034658 address this vulnerability; unpatched Windows 10 1703 systems running Microsoft Edge remain at risk.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
vendor_redhat7.0HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.