CVE-2017-8543 Microsoft Windows Search Remote Code Execution

Exploited in the wild Critical 9.8 Published 15 Jun 2017 Updated 21 Oct 2025

An attacker can execute arbitrary code and take control of the system due to improper handling of objects in memory by Windows Search.

Exploited in the wild: Since 24 May 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-8543?

CVE-2017-8543 is a critical memory corruption vulnerability in Microsoft Windows 10 1507, published on 15 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".

Weakness: CWE-281

Which versions are affected by CVE-2017-8543?

It affects 10 products.

Products include Microsoft Windows 10 1507, Microsoft Windows 10 1511, Microsoft Windows 10 1607, Microsoft Windows 10 1703, Microsoft Windows 7, Microsoft Windows 8.1 and 4 more.

How do I fix CVE-2017-8543?

No fix has been published for CVE-2017-8543 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Jun 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-8543 being exploited?

Yes. Attackers have exploited CVE-2017-8543 in the wild since at least 24 May 2022.

Public exploit code: 1 proofs of concept on GitHub.

All Microsoft Windows 10 1507 vulnerabilities

Sources

Also known as GHSA-w5g9-xvwm-4qf8.