Live › vulnerability › CVE-2017-8543
Go to dashboardRemote code execution in the Windows Search service (WSearch). An attacker sends crafted SMB messages to the service and can take over the machine. Microsoft reported it as exploited before the fix, and CISA lists it in KEV (added 2022-05-24). Affects Windows XP through Windows 10 1703 and Server 2003 through 2016. NVD scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). It is network-reachable, mainly over SMB in enterprise networks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Windows | vendor | – | – |
| Windows | vendor | XP SP3, XP x64 SP2, Vista, 7 SP1, 8, 8.1, RT 8.1, 10 (1507, 1511, 1607, 1703), Server 2003 SP2, 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016 before the June 2017 update | June 2017 security update; per-OS KB numbers unknown, see KB 4025686/4025687/4025688 |
Get-HotFix or wmic qfe list and compare against the KB for your OS in KB 4025686 (Server 2008/7/2008 R2/2012/8.1/2012 R2/10/2016), KB 4025687 (XP/Vista/8/2003) or KB 4025688 (Embedded)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
This page as .md · .json · in your agent: get_signal("CVE-2017-8543")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.