CVE-2017-8644

MEDIUM

Microsoft Edge - Information Disclosure via Memory Object Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-8644. PoCs published by Google Security Research.

AI-analyzed exploit summary This PoC exploits an out-of-bounds memory access vulnerability in Microsoft Edge's handling of datetime input elements, leading to a potential write primitive. The issue arises from an uninitialized index causing an invalid array access in CInputDateTimeScrollerElement::_SelectValueInternal.

Description

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8652 and CVE-2017-8662.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · htmldoswindows

https://www.exploit-db.com/exploits/42459

View Code ZIP pw:eip

This PoC exploits an out-of-bounds memory access vulnerability in Microsoft Edge's handling of datetime input elements, leading to a potential write primitive. The issue arises from an uninitialized index causing an invalid array access in CInputDateTimeScrollerElement::_SelectValueInternal.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393

No auth needed

Prerequisites: Target must be running vulnerable version of Microsoft Edge

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8644

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/42459/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/100044

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1039101

Scores

CVSS v3 4.3

EPSS 0.4440

EPSS Percentile 97.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

microsoft/edge

Microsoft Corporation/Microsoft Edge Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016.

Published Aug 08, 2017

Tracked Since Feb 18, 2026