{"id":"CVE-2017-8543","kind":"vulnerability","aliases":["CVE-2017-8543"],"related":[],"title":"Microsoft Windows: Microsoft Windows Search Remote Code Execution Vulnerability","description":"Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka \"Windows Search Remote Code Execution Vulnerability\".","summary":"Remote code execution in the Windows Search service (WSearch). An attacker sends crafted SMB messages to the service and can take over the machine. Microsoft reported it as exploited before the fix, and CISA lists it in KEV (added 2022-05-24). Affects Windows XP through Windows 10 1703 and Server 2003 through 2016. NVD scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). It is network-reachable, mainly over SMB in enterprise networks.","severity":"critical","cvss":10.0,"epss":0.74388,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows","fixed":["June 2017 security update; per-OS KB numbers unknown, see KB 4025686/4025687/4025688"],"affected":"XP SP3, XP x64 SP2, Vista, 7 SP1, 8, 8.1, RT 8.1, 10 (1507, 1511, 1607, 1703), Server 2003 SP2, 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016 before the June 2017 update","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","legacy-windows","smb","windows","windows-search"],"not_affected_if":["patched-june-2017","unknown","windows-search-service-disabled"],"how_to_check":"Run 'Get-HotFix' or 'wmic qfe list' and compare against the KB for your OS in KB 4025686 (Server 2008/7/2008 R2/2012/8.1/2012 R2/10/2016), KB 4025687 (XP/Vista/8/2003) or KB 4025688 (Embedded). I did not read the per-OS KB numbers, so look them up there. A machine with no June 2017 or later cumulative update or security-only rollup is exposed. Check whether the Windows Search service (WSearch) is running. Check whether SMB (TCP 445) is reachable from untrusted networks.","fix":"Install the June 2017 (or later) Microsoft security update for your Windows version. Per-OS KB numbers are in Microsoft Security Advisory 4025685 and the KBs it links (4025686, 4025687, 4025688). Microsoft released fixes for XP, Vista, 8 and Server 2003 even though they are out of support. Block inbound SMB (TCP 445) from untrusted networks. Retire unsupported Windows.","status":"open","published_at":"2017-06-15T01:29:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:57+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T21:15:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2017-8543 per vendor instructions (CISA required action). Exact KB numbers and fixed builds are not in the sources.","reach":"unknown","impact":"high","summary":"Windows Search mishandles objects in memory, letting a remote attacker run code on the affected Windows machine. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","windows-search"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker takes control of the Windows system remotely via Windows Search.","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2017-8543 to get affected builds, KB numbers and whether the attack is network-reachable.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000454,"input_tokens":2819,"output_tokens":345,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2017-8543 to get affected builds, KB numbers and whether the attack is network-reachable.","search":"'-05':69B '-2017':11A,14A '-24':70B '-8543':12A,15A '10':76B,142C '1511':144C '1607':145C '1703':77B,147C '2003':80B,114C '2008':123C '2012':138C '2016':82B,151C '2022':68B '7':119C '8':129C '8.1':131C,135C '9.8':87B 'add':67B 'affect':71B,160C 'aka':171C 'allow':152C 'attack':39B,154C 'av':88B 'cisa':62B 'code':7A,30B,175C 'control':157C 'craft':41B 'cve':10A,13A 'cvss':86B 'enterpris':102B 'execut':8A,31B,176C 'exploit':19B,57B 'fail':165C 'fix':60B 'gold':143C 'handl':167C 'infrastructur':20B 'kev':66B 'l/pr':90B 'legaci':22B 'legacy-window':21B 'list':63B 'machin':52B 'main':98B 'memori':170C 'messag':43B 'microsoft':1A,3A,16A,53B,104C 'n':92B 'n/ac':89B 'n/ui':91B 'network':96B,103B 'network-reach':95B 'nvd':83B 'object':168C 'r2':126C,140C 'reachabl':97B 'remot':6A,29B,174C 'report':54B 'rt':134C 'score':84B 'search':5A,28B,35B,164C,173C 'send':40B 'server':79B,113C,122C,137C,150C 'servic':36B,46B 'smb':24B,42B,100B 'sp1':120C,127C 'sp2':115C,124C 'sp3':107C 'system':161C 'take':49B,156C 'vista':117C 'vulner':9A,177C 'window':2A,4A,23B,25B,27B,34B,72B,75B,105C,108C,112C,116C,118C,121C,128C,130C,133C,136C,141C,149C,163C,172C 'windows':17A,18A 'windows-search':26B 'wsearch':37B 'x64':110C 'xp':73B,106C,109C 'xp2':111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-06-15T01:29:04+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-8543","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-8543","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2017-8543","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-8543","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2017-8543:46","url":null,"severity":null,"published_at":"2026-10-23T21:17:07+00:00","modified_at":"2026-10-23T21:17:07+00:00","first_seen_at":"2026-10-23T21:17:07+00:00","fetched_at":"2026-10-23T21:17:07+00:00","note":"Read MSRC Advisory 4025685 (Microsoft Learn), BleepingComputer's quote of the MSRC text, and the NVD/CVE record. The MSRC Update Guide page only loads through JavaScript, so per-OS KB numbers and builds are missing. Exploitation is from Microsoft's own pre-patch report plus the CISA KEV listing. I found no public PoC. I did not search X."},{"source":"nvd","external_id":"CVE-2017-8543","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8543","severity":null,"published_at":"2017-06-15T01:29:04+00:00","modified_at":"2026-06-17T01:26:33+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":931,"url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2017/4025685","title":"Microsoft Security Advisory 4025685 (June 2017 guidance)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":932,"url":"https://www.bleepingcomputer.com/news/microsoft/microsofts-june-patch-tuesday-fixes-two-vulnerabilities-used-in-live-attacks/","title":"BleepingComputer: June 2017 Patch Tuesday","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":933,"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8543","title":"NVD CVE-2017-8543","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}