CVE-2017-0022

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8...

6.5 MediumIn KEV

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

18.1%Up 6.7 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2017-0022
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

CVE List 6.5

Record: CVE-2017-0022
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-119
Updated: 2026-11-02

EUVDEUVD-2017-0389 6.5

Record: EUVD-2017-0389
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r6m8-274g-vhp5 4.3

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8...

Record: GHSA-r6m8-274g-vhp5
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness: CWE-119, CWE-200
Updated: 2026-11-02

CISA KEV No score

Microsoft XML Core Services Information Disclosure Vulnerability

Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.

Record: CVE-2017-0022
Weakness: CWE-200
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-0022 is a medium vulnerability (CVSS 6.5) in Microsoft Windows 8.1, published March 17, 2017. CISA lists it as known to be exploited, since May 24, 2022. EUVD reports exploitation since May 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.1%, the 97th percentile. No source names a fixed version.