CVE-2017-0037

KEVMicrosoft Edge and Internet Explorer Type Confusion Vulnerability

Description

Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedFeb 26, 2017

Last modifiedJun 17, 2026

Added to KEVMar 28, 2022

Remediation dueApr 18, 2022

References

securityfocus.com/bid/96088Broken LinkThird Party Advisory
securitytracker.com/id/1037905Broken LinkThird Party Advisory
securitytracker.com/id/1037906Broken LinkThird Party Advisory
0patch.blogspot.si/2017/03/0patching-another-0-day-internet.htmlExploitThird Party Advisory
bugs.chromium.org/p/project-zero/issues/detail?id=1011ExploitIssue Tracking
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037PatchVendor Advisory
exploit-db.com/exploits/41454/ExploitThird Party Advisory
exploit-db.com/exploits/42354/ExploitThird Party Advisory
exploit-db.com/exploits/43125/ExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0037US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1653 days
CVSS: 8.1 HIGH
EPSS (30-day exploit probability): 80.4% · top 1% of all CVEs
Weakness: CWE-843
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.