CVE-2017-8589
CriticalSummary
A vulnerability in Windows allows remote code execution due to improper handling of objects in memory by Windows Search. This affects multiple versions of Windows operating systems, including Windows 7, 8.1, and Windows 10.
Risk Assessment
An attacker could exploit this vulnerability to remotely execute code on the vulnerable system, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to install the latest security updates from Microsoft to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Windows Search
See all- CVE-2017-11788High
The vulnerability in Windows Search allows an unauthenticated attacker to remotely send specially crafted messages that could lead to a denial of service due to improper handling of objects in memory.
- CVE-2017-8620High
The vulnerability in Windows Search allows for remote code execution in various versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016. The issue arises from improper handling of objects in memory.
- CVE-2023-36884HighActively exploited
A vulnerability in Windows Search allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2026-69911High
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-69600High
Use after free in Windows Search Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-69585High
Incorrect type conversion or cast in the Windows Search component allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way that Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability".