Vulnerability record

CVE-2017-0037

Microsoft Edge and Internet Explorer Type Confusion Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Edge and Internet Explorer, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Apr 18, 2022.

Patch status

Official fix available since Sep 30, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Patch or advisory on portal.msrc.microsoft.com (opens in a new tab)

Description

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Edge and Internet Explorer	Microsoft	—	KEV
Internet Explorer	Microsoft	11	NVD
Microsoft Edge	Microsoft	all versions	NVD

Sources: KEV = CISA Known Exploited Vulnerabilities catalog; NVD = NIST National Vulnerability Database.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2017-0037 scored CVSS 8.1: Microsoft Edge and Internet Explorer, Microsoft Edge and Internet Explorer Type Confusion Vulnerability
CISA lists this as exploited in the wild. Unpatched Edge and Internet Explorer systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
Patch releasedUpdateKEVSep 30, 2026
Patch released for CVE-2017-0037: Microsoft Edge and Internet Explorer, Microsoft Edge and Internet Explorer Type Confusion Vulnerability
An official fix is now available for Microsoft Edge and Internet Explorer. This vulnerability is being exploited, so apply it promptly.
Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2017-0037
securityfocus.com http://www.securityfocus.com/bid/96088
securitytracker.com http://www.securitytracker.com/id/1037905
securitytracker.com http://www.securitytracker.com/id/1037906
0patch.blogspot.si https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html
bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=1011
portal.msrc.microsoft.com https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037
exploit-db.com https://www.exploit-db.com/exploits/41454/
exploit-db.com https://www.exploit-db.com/exploits/42354/
exploit-db.com https://www.exploit-db.com/exploits/43125/
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0037