# CVE-2017-0022: Microsoft XML Core Services Information Disclosure Vulnerability

Source: https://junglewise.ai/threats/cve-2017-0022-microsoft-xml-core-services-information-disclosure-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2017-0022 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2022-05-24

Microsoft XML Core Services (MSXML) improperly handles objects in memory, leading to an information disclosure vulnerability. An attacker can exploit this by hosting a crafted website to test for the existence of specific files on a user's disk.

Technologies: [Microsoft XML Core Services](https://junglewise.ai/threats/technologies/xml-core-services). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2017-0022 exploited in the wild?** Yes. CVE-2017-0022 is known to be exploited in the wild, first recorded on 24 May 2022. Treat it as urgent.

**How severe is CVE-2017-0022?** Critical severity, with a CVSS score of 6.5, published 24 May 2022.

**Which products and versions are affected?** Microsoft XML Core Services 3.0; Microsoft Windows 10 Gold, 1511, 1607; Microsoft Windows 7 SP1; Microsoft Windows 8.1; and 5 more.

**Is there a fix for CVE-2017-0022?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-0022 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2017-0022?** Check whether you run Microsoft XML Core Services. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft XML Core Services 3.0
- Microsoft Windows 10 Gold, 1511, 1607
- Microsoft Windows 7 SP1
- Microsoft Windows 8.1
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2008 SP2, R2 SP1
- Microsoft Windows Server 2012 Gold, R2
- Microsoft Windows Server 2016
- Microsoft Windows Vista SP2

## Timeline

- 2017-09-01: exploited: Exploit kit activity reported by 0patch.
- 2022-05-24: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2022-05-24: disclosed

## Related threats

- [Microsoft XML Core Services use after free privilege escalation](https://junglewise.ai/threats/cve-2026-50359-microsoft-xml-core-services-use-after-free-privilege-escalation)
- [Microsoft XML Core Services Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2012-1889-microsoft-xml-core-services-memory-corruption-vulnerability)