{"id":"CVE-2017-0037","aliases":["EUVD-2017-0404","GHSA-xpg5-jv85-754h"],"status":"published","title":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the...","description":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.80386,"percentile":0.99624,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-704","CWE-843"],"published":"2017-02-26T23:30:00Z","modified":"2026-06-17T00:56:57Z","kev":{"date_added":"2022-03-28","due_date":"2022-04-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-28"},{"source":"kev","since":"2022-03-28"}],"exploits":[{"source":"exploitdb","id":"EDB-41454","title":"Microsoft Edge / Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion","type":"dos","platform":"windows","date":"2017-02-24","verified":true,"url":"https://www.exploit-db.com/exploits/41454"},{"source":"exploitdb","id":"EDB-42354","title":"Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)","type":"remote","platform":"windows_x86-64","date":"2017-07-24","url":"https://www.exploit-db.com/exploits/42354"},{"source":"exploitdb","id":"EDB-43125","title":"Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007)","type":"remote","platform":"windows_x86","date":"2017-10-17","verified":true,"url":"https://www.exploit-db.com/exploits/43125"},{"source":"pocgithub","id":"chattopadhyaykittu/CVE-2017-0037","title":"chattopadhyaykittu/CVE-2017-0037","date":"2022-03-28","url":"https://github.com/chattopadhyaykittu/CVE-2017-0037"}],"products":[{"vendor":"microsoft","product":"edge"},{"vendor":"microsoft","product":"edge and internet explorer"},{"vendor":"microsoft","product":"internet_explorer"},{"vendor":"microsoft corporation","product":"internet browser"}],"references":[{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1011","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/96088","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41454/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/43125/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037905","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42354/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037906","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0037","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0037"},{"url":"https://www.exploit-db.com/exploits/41454"},{"url":"https://www.exploit-db.com/exploits/42354"},{"url":"https://www.exploit-db.com/exploits/43125"},{"url":"https://github.com/advisories/GHSA-xpg5-jv85-754h"}],"sources":{"cve":[{"id":"CVE-2017-0037","description":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.","status":"published","published":"2017-02-26T23:30:00Z","modified":"2025-10-21T23:55:46.41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:33:22.699876Z"}],"euvd":[{"id":"EUVD-2017-0404","description":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.","status":"published","published":"2017-02-26T23:30:00Z","modified":"2025-10-21T23:55:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-28","updated_at":"2026-11-02T19:49:39.684828Z"}],"ghsa":[{"id":"GHSA-xpg5-jv85-754h","title":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the...","description":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.","status":"published","published":"2022-05-17T00:22:33Z","modified":"2025-10-22T00:31:18Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-704","CWE-843"],"updated_at":"2026-11-02T15:04:03.556367Z"}],"kev":[{"id":"CVE-2017-0037","title":"Microsoft Edge and Internet Explorer Type Confusion Vulnerability","description":"Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.","cwes":["CWE-704"],"kev":{"date_added":"2022-03-28","due_date":"2022-04-18","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2017-0037","description":"Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.","status":"published","published":"2017-02-26T23:59:00.15Z","modified":"2026-06-17T00:56:57.983Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:03:43.325192Z"}]}}