# CVE-2017-0022: Microsoft XML Core Services Information Disclosure Vulnerability

CVE-2017-0022 is fixed in 34 products on 1 platform, first by KB4013198, released March 14, 2017. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on May 24, 2022. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/cve/CVE-2017-0022
- Priority: Patch now
- CVSS: 4.3 (Important)
- EPSS: 0.1807
- CISA KEV: listed May 24, 2022, federal due date Jun 14, 2022
- Exploited (vendor report): yes
- Publicly disclosed: no
- Vendor exploitability assessment: Exploitation More Likely
- Published: Mar 14, 2017
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0022

## Description

<p>An information vulnerability exists when <a href="https://technet.microsoft.com/en-us/library/security/dn8">Microsoft XML Core Services (MSXML)</a> improperly handles objects in memory. Successful exploitation of the vulnerability could allow the attacker to test for the presence of files on disk.</p> <p>To exploit the vulnerability, an attacker could host a specially-crafted website that is designed to invoke MSXML through Internet Explorer. However, an attacker would have no way to force a user to visit such a website. Instead, an attacker would typically have to convince a user to either click a link in an email message or a link in an Instant Messenger request that would then take the user to the website.</p> <p>The update addresses the vulnerability by changing the way MSXML handles objects in memory.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 Version 1511 for 32-bit Systems | 10586.839 | [KB4013198](https://patchblox.com/security/data/fix/microsoft/kb4013198.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 Version 1511 for x64-based Systems | 10586.839 | [KB4013198](https://patchblox.com/security/data/fix/microsoft/kb4013198.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 Version 1607 for 32-bit Systems | 14393.953 | [KB4013429](https://patchblox.com/security/data/fix/microsoft/kb4013429.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 Version 1607 for x64-based Systems | 14393.953 | [KB4013429](https://patchblox.com/security/data/fix/microsoft/kb4013429.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 for 32-bit Systems | 10240.17319 | [KB4012606](https://patchblox.com/security/data/fix/microsoft/kb4012606.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 10 for x64-based Systems | 10240.17319 | [KB4012606](https://patchblox.com/security/data/fix/microsoft/kb4012606.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 7 for 32-bit Systems Service Pack 1 |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 7 for 32-bit Systems Service Pack 1 |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 7 for x64-based Systems Service Pack 1 |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 7 for x64-based Systems Service Pack 1 |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 8.1 for 32-bit systems |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 8.1 for 32-bit systems |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 8.1 for x64-based systems |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows 8.1 for x64-based systems |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows RT 8.1 |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 for 32-bit Systems Service Pack 2 |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 for Itanium-Based Systems Service Pack 2 |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 for x64-based Systems Service Pack 2 |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 |  | [KB4012217](https://patchblox.com/security/data/fix/microsoft/kb4012217.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 |  | [KB4012214](https://patchblox.com/security/data/fix/microsoft/kb4012214.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 (Server Core installation) |  | [KB4012217](https://patchblox.com/security/data/fix/microsoft/kb4012217.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 (Server Core installation) |  | [KB4012214](https://patchblox.com/security/data/fix/microsoft/kb4012214.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 R2 |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 R2 |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 R2 (Server Core installation) |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2012 R2 (Server Core installation) |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2016 | 14393.953 | [KB4013429](https://patchblox.com/security/data/fix/microsoft/kb4013429.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Server 2016 (Server Core installation) | 14393.953 | [KB4013429](https://patchblox.com/security/data/fix/microsoft/kb4013429.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Vista Service Pack 2 |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Microsoft XML Core Services 3.0 on Windows Vista x64 Edition Service Pack 2 |  | [KB3216916](https://patchblox.com/security/data/fix/microsoft/kb3216916.md) | Mar 14, 2017 |
| Microsoft | Windows 8.1 for 32-bit systems |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Windows 8.1 for 32-bit systems |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Windows 8.1 for x64-based systems |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Windows 8.1 for x64-based systems |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB4012215](https://patchblox.com/security/data/fix/microsoft/kb4012215.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |  | [KB4012212](https://patchblox.com/security/data/fix/microsoft/kb4012212.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 |  | [KB4012217](https://patchblox.com/security/data/fix/microsoft/kb4012217.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 |  | [KB4012214](https://patchblox.com/security/data/fix/microsoft/kb4012214.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 (Server Core installation) |  | [KB4012217](https://patchblox.com/security/data/fix/microsoft/kb4012217.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 (Server Core installation) |  | [KB4012214](https://patchblox.com/security/data/fix/microsoft/kb4012214.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 R2 |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 R2 |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) |  | [KB4012213](https://patchblox.com/security/data/fix/microsoft/kb4012213.md) | Mar 14, 2017 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) |  | [KB4012216](https://patchblox.com/security/data/fix/microsoft/kb4012216.md) | Mar 14, 2017 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.