CVE-2017-8755

What it actually does

The scripting engine in Microsoft Edge mishandles objects in memory, permitting an attacker-supplied web page to corrupt memory and achieve arbitrary code execution in the context of the current user.

Why it matters to the business

Successful exploitation can lead to full compromise of a user's workstation, enabling theft of credentials, installation of persistent malware, or lateral movement inside the organization; the issue affects widely deployed browser and Windows versions, increasing operational risk until patches are applied.

How an attack unfolds

An attacker crafts a malicious web page that triggers the memory corruption when rendered in Microsoft Edge. When a victim visits the page, the scripting engine corrupts memory and allows the attacker to execute arbitrary code, typically to download and run additional payloads.

How to fix it

Apply the security updates released by Microsoft for the affected Windows 10 and Windows Server 2016 builds that contain the patched Edge scripting engine. Disable Edge where feasible or enforce strict web browsing policies until updates can be deployed.

How to confirm the fix worked

Confirm the presence of the Microsoft security update corresponding to the September 2017 Patch Tuesday for Edge and Windows 10/Server 2016; verify Edge version numbers match or exceed the fixed releases listed in the Microsoft advisory.

Typical attack path

1. Attacker hosts a malicious website containing specially crafted JavaScript or HTML.
2. Victim is tricked into visiting the site via phishing, malicious ads, or compromised legitimate sites.
3. Edge scripting engine processes the page and triggers the memory corruption.
4. Attacker gains code execution in the user's context and downloads/runs follow-on malware.

How to detect it

Review web proxy and browser history logs for visits to suspicious domains around the time of suspected incidents; examine process creation and memory dumps on endpoints for unexpected Edge child processes or injected code.

What your security team should do

• Prioritize deployment of the September 2017 cumulative updates to all affected Windows 10 and Server 2016 systems.
• Block or restrict use of legacy Edge builds until patches are confirmed installed.
• Monitor for any remaining unpatched systems via vulnerability scanning.