Microsoft Edge and Internet Explorer Type Confusion Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2017 · Catalog

   Detected

   Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

2. Mar 28, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 18, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

Affected

• cpe microsoft/edgeversion unspecified
• cpe microsoft/internet explorer11
• vendor Microsoft Edge and Internet Explorerversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2017-0037

  Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.

  cisa.gov
• CVE.orgVulnerability recordCVE-2017-0037

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2017-0037

  30-day exploitation probability 80.4%

  first.org
• Exploit DatabasePublic exploit reference41454

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference42354

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference43125

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2017-0037

  Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Casc

  nvd.nist.gov

References

• Broken Link · securityfocus.com
• Broken Link · securitytracker.com
• Broken Link · securitytracker.com
• Exploit · 0patch.blogspot.si
• Exploit · bugs.chromium.org
• CISA note · nvd.nist.gov
• Patch · portal.msrc.microsoft.com
• Exploit · exploit-db.com