Description
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
In plain language
AI Worth attentionCVE-2017-11890 is a Microsoft Internet Explorer security flaw that can let an attacker run code on your PC when you open a specially crafted webpage; if your business still uses Internet Explorer, you should act and update.
CVE-2017-11890 is a scripting engine memory corruption issue in Internet Explorer that can be triggered by a user opening attacker-controlled content, enabling arbitrary code execution in the current user context; public exploit code exists, but it is not listed in CISA KEV.
What to do now
- Check which devices in your business use Microsoft Internet Explorer (including any legacy Windows versions) and confirm the OS/browser patch level.
- Apply Microsoft’s remediation guidance for CVE-2017-11890 on every affected machine (Windows updates per the advisory linked below).
- If you cannot patch immediately, reduce exposure by preventing users from opening untrusted webpages/files in Internet Explorer and routing web traffic to a safer browser.
- After patching, verify updates are installed and review security logs for any Internet Explorer crashes or suspicious activity around browsing sessions.
CVSS Vector Breakdown
AV:NAttack VectorAC:HAttack ComplexityPR:NPrivileges RequiredUI:RUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.
View exploit detailsAttack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2017-11890 and every CVE in our database. Create a free account — no credit card required.
Create Free Account