CVE-2017-0037
Microsoft Edge and Internet Explorer Type Confusion Vulnerability
Description
CVE-2017-0037 is a type confusion vulnerability in the layout engine shared by Microsoft Edge and Internet Explorer that allows a remote attacker to execute arbitrary code on the target system by luring a user to a specially crafted webpage. The vulnerability occurs when the browser engine incorrectly handles objects in memory during page rendering, creating a type confusion condition that can be leveraged for remote code execution. CISA added CVE-2017-0037 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation. With an EPSS score of 55.3% (98.0th percentile), this vulnerability is heavily targeted in browser exploit campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | edge | All versions |
| microsoft | internet explorer | 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/96088(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037905(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037906(Broken Link, Third Party Advisory, VDB Entry)
- https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html(Exploit, Third Party Advisory)
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1011(Exploit, Issue Tracking, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41454/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42354/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43125/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0037(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-843 describes a weakness where a program accesses a resource using an incompatible type, leading to undefined behavior that can be exploited for code execution or information disclosure. In CVE-2017-0037, the Microsoft Edge and Internet Explorer layout engine incorrectly casts objects during rendering, creating a type confusion condition that allows an attacker to execute arbitrary code in the context of the browser process.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2017-0037 enables remote code execution through both Microsoft Edge and Internet Explorer, affecting users across multiple browsers on Windows systems. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, which can include installing malware, stealing data, or pivoting to further compromise the system. The dual-browser impact (Edge and IE) broadens the attack surface significantly, as nearly all Windows users at the time of disclosure used one of these browsers. When combined with a privilege escalation vulnerability, this RCE bug can lead to complete system compromise from a simple website visit.
Exploit Maturity
CVE-2017-0037 is confirmed as actively exploited in the wild by CISA through its KEV catalog listing on March 28, 2022. The EPSS score of 55.3% (98.0th percentile) reflects very high exploitation activity, consistent with the attractiveness of browser type confusion vulnerabilities for drive-by download campaigns. The vulnerability's impact on both Edge and Internet Explorer makes it particularly valuable to exploit developers, as it provides a single exploit path for two browsers sharing the same vulnerable engine component.
Remediation
- Apply the Microsoft security update from March 2017 (Patch Tuesday) that addresses CVE-2017-0037 in both Microsoft Edge and Internet Explorer.
- Migrate users to modern browsers that receive regular security updates, as both legacy Edge (EdgeHTML) and Internet Explorer have reached end of life.
- Deploy web content filtering and browser isolation solutions to reduce exposure to malicious web content that could exploit browser vulnerabilities.
- Enable Enhanced Protected Mode in Internet Explorer and Windows Defender Exploit Guard mitigations for both Edge and IE to limit the impact of successful browser exploitation.
Technical Details
CVE-2017-0037 is a type confusion vulnerability in the layout engine (Trident/EdgeHTML) shared by Microsoft Internet Explorer and the legacy version of Microsoft Edge. The vulnerability occurs during HTML/CSS rendering when the layout engine processes specially crafted page elements and incorrectly casts an object to an incompatible type, resulting in a type confusion condition. This type confusion allows an attacker to overwrite critical memory structures, such as virtual function table (vtable) pointers, enabling redirection of code execution to attacker-controlled shellcode. The exploit is delivered via a malicious webpage and requires user interaction (visiting the page), but no authentication or special privileges are needed.
Frequently Asked Questions
Is CVE-2017-0037 being actively exploited?
Yes, CVE-2017-0037 is confirmed as actively exploited in the wild by CISA. The EPSS score of 55.3% (98.0th percentile) indicates very high real-world exploitation activity, with documented use in browser exploit chains and drive-by download campaigns.
What products are affected by CVE-2017-0037?
CVE-2017-0037 affects both Microsoft Edge (legacy EdgeHTML version) and Internet Explorer 10/11 across multiple Windows versions. The shared layout engine means both browsers are vulnerable through a single underlying flaw.
How do I fix CVE-2017-0037?
Apply the Microsoft security update from March 2017. Migrate away from legacy Edge and Internet Explorer to modern browsers. Deploy web filtering and browser isolation to reduce exposure to browser exploit kits.
How severe is CVE-2017-0037?
CVE-2017-0037 is a critical remote code execution vulnerability with an EPSS score in the 98.0th percentile. The type confusion flaw enables reliable code execution through a simple webpage visit, affecting two major Microsoft browsers simultaneously. It is actively exploited and should be treated as a high-priority patching target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.