CVE-2017-8543

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-05-24Remediation due 2022-06-14

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

9.8

CVSS

74.2%

EPSS (exploit prob.)

99th

EPSS percentile

2017-06-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-281

Affected products

Vendor	Product	Affected versions
microsoft	windows_10_1507	all versions
microsoft	windows_10_1507	all versions
microsoft	windows_10_1511	all versions
microsoft	windows_10_1511	all versions
microsoft	windows_10_1607	all versions
microsoft	windows_10_1607	all versions
microsoft	windows_10_1703	all versions
microsoft	windows_10_1703	all versions
microsoft	windows_7	all versions
microsoft	windows_8.1	all versions
microsoft	windows_rt_8.1	all versions
microsoft	windows_server_2008	all versions
microsoft	windows_server_2008	r2
microsoft	windows_server_2008	r2
microsoft	windows_server_2012	all versions
microsoft	windows_server_2012	r2
microsoft	windows_server_2016	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-8543