CVE-2017-0201

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Internet Explorer in the way that the JScript and VBScript engines render when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0093.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Microsoft Corporation	Internet Explorer	The Jscript and VBScript engine in Microsoft Internet Explorer 9 and Internet Explorer 10

References

http://www.securityfocus.com/bid/97454Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038238
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0201Patch, Vendor Advisory
http://www.securityfocus.com/bid/97454Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038238
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0201Patch, Vendor Advisory

Timeline

Published: Apr 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-02027.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt m CVE-2017-02034.3A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted do CVE-2017-02045.5Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to byp CVE-2017-02057.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memo CVE-2017-02076.5Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Brow CVE-2017-02084.3An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory CVE-2017-02108.8An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an CVE-2017-02115.5An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and CVE-2017-02127.6Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 CVE-2017-02137.3Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2 CVE-2017-02147.0Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wi CVE-2017-02155.3Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that