CVE-2017-0037VulnerabilityPublished 03/28/2022Updated 10/24/2026

CVE-2017-0037: Microsoft Edge and Internet Explorer Type Confusion Vulnerability

Affects Microsoft Edge and Internet ExplorerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/28/2022
KEV deadline: 04/18/2022
EPSS: 80.4% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-0037 (opens in a new tab)

Description

CVE-2017-0037 is a type confusion vulnerability in the mshtml.dll component of Microsoft Edge and Internet Explorer. This flaw allows remote code execution, enabling attackers to potentially execute arbitrary code on affected systems. The vulnerability has been exploited in the wild, indicating active use by threat actors. No specific affected versions or patch information is provided in the available data.

Summary

Microsoft Edge and Internet Explorer contain a type confusion vulnerability in the mshtml.dll library, identified as CVE-2017-0037. This vulnerability permits remote code execution by exploiting the type confusion flaw. It has been confirmed to be exploited in the wild, underscoring its practical risk. The vulnerability is categorized under CWE-704 (Incorrect Type Conversion or Cast). No vendor advisory or patch information is included in the provided data.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems running Microsoft Edge or Internet Explorer. This can lead to full compromise of the affected system, including installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The presence of known exploits in the wild increases the urgency and risk associated with this vulnerability.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are confirmed, users should apply any available security updates from Microsoft, use enhanced security configurations, and consider disabling or limiting use of affected browsers where feasible.

Weaknesses

CWE-704Incorrect Type Conversion or Cast (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:11:58 UTC

Weaknesses

References

Related threats