CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability
Description
CVE-2017-8543 is a remote code execution vulnerability in the Windows Search service of Microsoft Windows that allows an attacker to take control of an affected system. The vulnerability occurs when Windows Search fails to properly handle objects in memory, enabling an attacker to send specially crafted SMB messages to the Windows Search service and execute arbitrary code with elevated privileges. Successful exploitation grants the attacker complete control over the target system. CVE-2017-8543 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and its EPSS percentile of 99.3% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98824(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038667(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8543(Mitigation, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8543(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes weaknesses where a product performs operations on a memory buffer without properly restricting those operations to the intended boundaries. In CVE-2017-8543, the Windows Search service fails to properly validate and handle objects in memory when processing search requests, leading to a memory corruption condition that an attacker can exploit to achieve remote code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-8543 is remotely exploitable without authentication or user interaction, making it a critical threat. An attacker can send crafted SMB messages to the Windows Search service over the network, triggering the memory corruption and achieving code execution with SYSTEM-level privileges. This grants full control over the affected system, compromising confidentiality, integrity, and availability. The attack vector is network-based, and the Windows Search service is enabled by default on all Windows systems, creating a wide attack surface. The EPSS percentile of 99.3% reflects near-certain active exploitation. CISA has confirmed active exploitation and included CVE-2017-8543 in the KEV catalog, underscoring the urgent need for patching across enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-8543 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 99.3% indicates near-certain exploitation probability. Microsoft acknowledged at the time of disclosure that this vulnerability was being actively exploited in targeted attacks. The network-based attack vector combined with no requirement for authentication or user interaction makes this vulnerability particularly attractive for automated exploitation and worm-like propagation scenarios, similar to other SMB-related vulnerabilities from the same era.
Remediation
- Apply the Microsoft security update that addresses CVE-2017-8543 as specified by the vendor. This is the required remediation action per CISA's KEV catalog.
- If immediate patching is not possible, consider disabling the Windows Search service on systems where it is not required, particularly on servers and internet-facing systems.
- Block SMB traffic (TCP port 445) at network boundaries and restrict internal SMB communication through network segmentation to limit the attack surface.
- Deploy intrusion detection and prevention system (IDS/IPS) rules to detect exploitation attempts targeting the Windows Search service.
- Monitor Windows event logs and security monitoring tools for indicators of compromise, including unexpected Windows Search service crashes, unusual SMB traffic patterns, or signs of lateral movement following potential exploitation.
Technical Details
CVE-2017-8543 is a memory corruption vulnerability in the Windows Search service (WSearch). The vulnerability is triggered when the service improperly handles objects in memory while processing specially crafted SMB messages. This falls under CWE-119, where the service fails to restrict memory operations to valid boundaries. An attacker sends crafted SMB packets to the Windows Search service, which corrupts memory structures in a way that redirects execution to attacker-controlled code. The attack requires no authentication or user interaction, and execution occurs with the privileges of the Windows Search service, which runs as SYSTEM. The vulnerability affects multiple Windows versions including Windows 7, 8.1, 10, Server 2008, 2012, and 2016, as the Windows Search service is a core operating system component enabled by default. The SMB-based attack vector means that any system with port 445 accessible is a potential target.
Frequently Asked Questions
Is CVE-2017-8543 being actively exploited?
Yes, CVE-2017-8543 has been actively exploited in targeted attacks. CISA has confirmed active exploitation and added it to the KEV catalog. Microsoft acknowledged exploitation at the time of disclosure. The EPSS percentile of 99.3% reflects near-certain exploitation activity.
What products are affected by CVE-2017-8543?
CVE-2017-8543 affects the Windows Search service in multiple Microsoft Windows versions, including Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, Windows Server 2016, and Windows RT 8.1. The Windows Search service is enabled by default on all affected systems.
How do I fix CVE-2017-8543?
Apply the relevant Microsoft security update that patches CVE-2017-8543. Additionally, block SMB traffic at network boundaries and consider disabling the Windows Search service on systems where it is not needed. See the Remediation section for detailed steps.
How severe is CVE-2017-8543?
CVE-2017-8543 is a remote code execution vulnerability with an EPSS percentile of 99.3%. It requires no authentication or user interaction and grants SYSTEM-level code execution, making it one of the most severe Windows vulnerabilities from 2017. The network-based attack vector and the default-enabled status of the Windows Search service create a very large attack surface.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.