CVE-2017-0037

2017-02-2623:30:00

microsoft

www.cve.org

6.5 Medium

AI Score

Confidence

High

0.973 High

EPSS

Percentile

99.9%

JSON

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

CNA Affected

[
  {
    "product": "Internet Browser",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Internet Explorer 10 and 11 and Edge"
      }
    ]
  }
]