CVE-2017-0100 EXPLOIT
7.8
HIGH · CVSS 3.0 · EPSS 5% (pctl 92)
Patch early
A public exploit exists.
Description
A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows local users to gain privileges via a crafted application, aka "Windows HelpPane Elevation of Privilege Vulnerability."
Scoring
| CVSS | 7.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 4.96% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-03-17 |
| Last modified | 2026-06-17 |
Affected (7)
| Vendor | Product |
|---|---|
| microsoft | windows 10 |
| microsoft | windows 7 |
| microsoft | windows 8.1 |
| microsoft | windows rt 8.1 |
| microsoft | windows server 2008 |
| microsoft | windows server 2012 |
| microsoft | windows server 2016 |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft Windows - COM Session Moniker Privilege Escalation (MS17-012) | 2017-03-15 |
References
- http://blog.inspired-sec.com/archive/2017/03/17/COM-Moniker-Privesc.html
- http://www.securityfocus.com/bid/96700
- http://www.securitytracker.com/id/1038001
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1021
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0100
- https://www.exploit-db.com/exploits/41607/
- http://blog.inspired-sec.com/archive/2017/03/17/COM-Moniker-Privesc.html
- http://www.securityfocus.com/bid/96700
- http://www.securitytracker.com/id/1038001
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1021
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0100
- https://www.exploit-db.com/exploits/41607/
→ the Explorer · watch your stack · NVD