Microsoft Edge: Out-of-bounds read in CInputDateTimeScrollerElement::_SelectValueInternal(CVE-2017-8644)

The vulnerability has been confirmed on Windows 10 Enterprise 64-bit OS version 1607, OS build 14393.1198 and Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. PoC: ========================================== input:focus transform: scale10; =========================================...

Microsoft Edge 38.14393.1066.0 - CInputDateTimeScrollerElement::_SelectValueInternal Out-of-Bounds Read

Microsoft Edge 38.14393.1066.0 - CInputDateTimeScrollerElement::SelectValueInternal Out-of-Bounds Read input:focus transform: scale10; UpdateSelectedthis-arrayatoffset0xB8this-indexatoffset0xD4.ptratindex0, ...; ... The problem is that the index in the PoC has unsigned 32-bit value of 0xffffffff,...

Microsoft Edge CInputDateTimeScrollerElement::_SelectValueInternal Out-Of-Bounds Read

Microsoft Edge: Out-of-bounds read in CInputDateTimeScrollerElement::SelectValueInternal CVE-2017-8644 The vulnerability has been confirmed on Windows 10 Enterprise 64-bit OS version 1607, OS build 14393.1198 and Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. PoC:...