Improper input validation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows…
Priority LOW 37CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a spoofing vulnerability in the way they parse HTTP content, aka "Microsoft Browser Spoofing Vulnerability."
Why it matters now
EPSS 0.05331 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 | Microsoft IE 11 and Edge | — | No fix listed | CNA |
- Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 VendorMicrosoft Affected Microsoft IE 11 and Edge Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1511 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | r2 sp1 | Running on | Microsoft |
- cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8602
- 2026-10-03 Alias added: GHSA-cp54-fjgm-8hr7
More Microsoft Edge vulnerabilities
- TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2017-8602 · CVE Program
- CVE-2017-8602 · NVD
- FIRST EPSS
- GHSA-cp54-fjgm-8hr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences