CVE-2017-0022: Microsoft XML Core Services Information Disclosure Vulnerability

Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 18.1% chance of exploitation in the next 30 days.

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."

Affected products

• Microsoft Windows 8.1: affected versions not specified
• Microsoft Windows Server 2008: version r2 only
• Microsoft Windows Server 2012: affected versions not specified; version r2 only
• Microsoft XML Core Services: version 3.0 only

Published 2017-03-17. Last modified 2026-06-17.