CVE-2017-8692 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Corporation Windows Uniscribe

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

7.5HIGHNVD

EPSS

31.5%

top 3.21%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Corporation Windows Uniscribe Microsoft Windows 10 Microsoft Windows Server 2012

Timeline

PublishedSep 13

Latest updateMay 17

Description

The Windows Uniscribe component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote code execution vulnerability when it fails to properly handle objects in memory, aka "Uniscribe Remote Code Execution Vulnerability".

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5microsoft_corporation/windows_uniscribeMicrosoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

▶NVDmicrosoft/windowsr2

▶NVDmicrosoft/windows_101511, 1607, 1703+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-6mr4-5xch-qrcv: The Windows Uniscribe component on Microsoft Windows 8↗2022-05-17

▶

CVEList

CVE-2017-8692: The Windows Uniscribe component on Microsoft Windows 8↗2017-09-13

▶

📋Vendor Advisories

Microsoft

Windows Uniscribe Remote Code Execution Vulnerability↗2017-09-12

▶