CVE-2017-6517

Critical

Published: 23/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Microsoft Skype version 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The issue arises from the way .dll files are loaded by Skype.

Risk Assessment

This vulnerability poses a serious risk to organizations as an attacker could gain full control over the system without the user's knowledge.

Recommendation

It is recommended to update Skype to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.

Original NVD description (English source)

Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.The specific flaw exists within the handling of DLL (api-ms-win-core-winrt-string-l1-1-0.dll) loading by the Skype.exe process.