CVE-2017-8487

🗓️ 15 Jun 2017 20:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 99 Views🌐 WEB

Windows OLE code execution vulnerability in Windows XP and Server 200

Reporter	Title	Published	Views	Family All 18
0day.today	Microsoft Windows - IOCTL 0x390400, operation code 0x00020000 Kernel KsecDD Pool Memory Disclosure E	21 Jun 201700:00	–	zdt
Circl	CVE-2017-8487	15 Jun 201709:40	–	circl
CNVD	Microsoft Windows OLE Remote Code Execution Vulnerability (CNVD-2017-09716)	8 Jun 201700:00	–	cnvd
Check Point Advisories	Microsoft Windows OLE Global Buffer Overflow (CVE-2017-8487)	13 Jul 201700:00	–	checkpoint_advisories
Cvelist	CVE-2017-8487	15 Jun 201720:00	–	cvelist
Huawei	Security Advisory - Multiple Vulnerabilities Released on Microsoft Security Advisory 4025685	16 Jun 201700:00	–	huawei
Kaspersky	KLA11056 Multiple arbitrary code execution vulnerabilities in Microsoft Windows	15 Jun 201700:00	–	kaspersky
NVD	CVE-2017-8487	15 Jun 201720:29	–	nvd
OpenVAS	Huawei Data Communication: Multiple Vulnerabilities Released on Microsoft security advisory 4025685 (huawei-sa-20170909-01-windows)	5 Jun 202000:00	–	openvas
OpenVAS	Microsoft Windows 'olecnv32.dll' Remote Code Execution Vulnerability (KB4025218)	16 Jun 201700:00	–	openvas

NVD

Node

microsoft windows_server_2003Match-

microsoft windows_xpMatch-

[
  {
    "product": "Microsoft Windows",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Windows XP SP3, Windows XP x64 SP2, Windows Server 2003 SP2"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/99013
exploit-db	www.exploit-db.com/exploits/42211/
support	www.support.microsoft.com/en-us/help/4025218/security-update-for-windows-xp-and-windows-server-2003
securitytracker	www.securitytracker.com/id/1038702

Parameter	Position	Path	Description	CWE
0x390400	path	\Device\KsecDD	Windows OLE kernel vulnerability CVE-2017-8487 exploited via IOCTL to leak uninitialized pool memory from \Device\KsecDD, enabling potential local privilege escalation or information disclosure
InputBuffer structure for Ioctl call (DeviceIoControl) with input data used to trigger leak	path	\Device\KsecDD	Windows OLE kernel vulnerability CVE-2017-8487 exploited via IOCTL to leak uninitialized pool memory from \Device\KsecDD, enabling potential local privilege escalation or information disclosure

13 May 2026 00:24Current

7.7High risk

Vulners AI Score7.7

CVSS 37.8

CVSS 29.3

EPSS0.69337