--- id: "CVE-2017-8543" kind: "vulnerability" aliases: ["CVE-2017-8543"] title: "Microsoft Windows: Microsoft Windows Search Remote Code Execution Vulnerability" severity: "critical" cvss: 10.0 epss: 0.74388 exploited: true status: "open" category: "infrastructure" products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows", "fixed": ["June 2017 security update; per-OS KB numbers unknown, see KB 4025686/4025687/4025688"], "affected": "XP SP3, XP x64 SP2, Vista, 7 SP1, 8, 8.1, RT 8.1, 10 (1507, 1511, 1607, 1703), Server 2003 SP2, 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016 before the June 2017 update", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "legacy-windows", "smb", "windows", "windows-search"] not_affected_if: ["patched-june-2017", "unknown", "windows-search-service-disabled"] published_at: "2017-06-15T01:29:04+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T21:57:35+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-8543", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-8543", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:17:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8543", "first_seen_at": "2026-10-23T21:57:35+00:00"}] --- # Microsoft Windows: Microsoft Windows Search Remote Code Execution Vulnerability Remote code execution in the Windows Search service (WSearch). An attacker sends crafted SMB messages to the service and can take over the machine. Microsoft reported it as exploited before the fix, and CISA lists it in KEV (added 2022-05-24). Affects Windows XP through Windows 10 1703 and Server 2003 through 2016. NVD scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). It is network-reachable, mainly over SMB in enterprise networks. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Microsoft Windows affected ? fixed ? - vendor:Windows affected XP SP3, XP x64 SP2, Vista, 7 SP1, 8, 8.1, RT 8.1, 10 (1507, 1511, 1607, 1703), Server 2003 SP2, 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016 before the June 2017 update fixed June 2017 security update; per-OS KB numbers unknown, see KB 4025686/4025687/4025688 ## How to check Run 'Get-HotFix' or 'wmic qfe list' and compare against the KB for your OS in KB 4025686 (Server 2008/7/2008 R2/2012/8.1/2012 R2/10/2016), KB 4025687 (XP/Vista/8/2003) or KB 4025688 (Embedded). I did not read the per-OS KB numbers, so look them up there. A machine with no June 2017 or later cumulative update or security-only rollup is exposed. Check whether the Windows Search service (WSearch) is running. Check whether SMB (TCP 445) is reachable from untrusted networks. ## Fix Install the June 2017 (or later) Microsoft security update for your Windows version. Per-OS KB numbers are in Microsoft Security Advisory 4025685 and the KBs it links (4025686, 4025687, 4025688). Microsoft released fixes for XP, Vista, 8 and Server 2003 even though they are out of support. Block inbound SMB (TCP 445) from untrusted networks. Retire unsupported Windows. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-8543 - 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-8543 - 2026-10-23T21:17:07+00:00 analyst — Read MSRC Advisory 4025685 (Microsoft Learn), BleepingComputer's quote of the MSRC text, and the NVD/CVE record. The MSRC Update Guide page only loads through JavaScript, so per-OS KB numbers and builds are missing. Exploitation is from Microsoft's own pre-patch report plus the CISA KEV listing. I found no public PoC. I did not search X. - 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-8543 ## Documents - [advisory] Microsoft Security Advisory 4025685 (June 2017 guidance) https://learn.microsoft.com/en-us/security-updates/securityadvisories/2017/4025685 - [describes] BleepingComputer: June 2017 Patch Tuesday https://www.bleepingcomputer.com/news/microsoft/microsofts-june-patch-tuesday-fixes-two-vulnerabilities-used-in-live-attacks/ - [describes] NVD CVE-2017-8543 https://nvd.nist.gov/vuln/detail/CVE-2017-8543 ## From the sources Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability". --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_