Information disclosure in Microsoft Internet Explorer
Priority LOW 33CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how Internet Explorer handle objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11906 and CVE-2017-11919.
Why it matters now
EPSS 0.06423 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Internet Explorer | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016. | — | No fix listed | CNA |
- Internet Explorer VendorMicrosoft Affected Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016. Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* | 1511 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* | 1607 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* | 1703 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* | 1709 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
- cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* | 9 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:* | 10 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-11887
- 2026-10-03 Alias added: GHSA-6w28-cfm8-7667
More Microsoft Internet Explorer vulnerabilities
- TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-01386 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01340 Scripting Engine Memory Corruption Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
- TI-2017-00204 Out-of-bounds write in Microsoft Internet Explorer KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2017-11887 · CVE Program
- CVE-2017-11887 · NVD
- FIRST EPSS
- GHSA-6w28-cfm8-7667 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences