CVE-2017-8751

This is a flaw in Microsoft Edge where viewing a malicious page or file can cause Edge to “mis-handle” data in memory. If it works, the attacker can run code as the same user currently logged into Windows—similar to tricking a staff member into opening a booby-trapped document that then executes instructions on their behalf.

This matters if you run Microsoft Windows 1703 and your users browse with Microsoft Edge on those systems. An attacker generally needs to get a user to open specially crafted content (so it’s not something that automatically hits you just by having the computer connected). It’s a risk when the vulnerable Edge path is reachable through normal browsing and user interaction occurs.

This is AMBER because a public exploit is available, meaning attackers can realistically target vulnerable systems. However, it is not listed in CISA’s KEV set in the provided findings, so it is not confirmed as a broad, confirmed campaign there. Treat it as a timely patch priority for any Windows 1703 devices still running Microsoft Edge.