CVE-2017-8734

Imagine opening a webpage that’s been crafted to trick Edge into reading “where it shouldn’t” in memory. Instead of just showing the page, the attacker may get Edge to run their own code using the permissions of the currently logged-in user, which can lead to malware being installed or files being accessed.

This matters if you use Microsoft Edge on Windows 10 Gold, 1511, 1607, or 1703, or on Windows Server 2016—those combinations are specifically called out for this issue. The danger is tied to opening a maliciously crafted page (user interaction is required), and it does not need a login to exploit. Treat it as a risk when an attacker can deliver a crafted page to your users (for example via browsing or clickable content), especially if your Edge/Windows combination is still unpatched.

This is an Amber issue because it enables remote code execution in the context of the current user, and a public exploit is available. Even though user interaction is required, attackers can commonly achieve this by getting users to open a malicious page, so you should address it promptly on any affected devices.