CVE-2017-0170

medium

Published 2017-07-11 · Modified 2026-05-13

CVSS v3

6.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2

4.3

VIR risk

6.5

Description

Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML input, aka "Windows Performance Monitor Information Disclosure Vulnerability".

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secure@microsoft.com — https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170

OS impact

OS	Version	Status
windows	-	affected
windows	1511	affected
windows	1607	affected
windows	1703	affected
windows		affected
windows	r2	affected

References

http://www.securityfocus.com/bid/99398
http://www.securitytracker.com/id/1038855
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170
http://www.securityfocus.com/bid/99398
http://www.securitytracker.com/id/1038855
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170

CWEs

CWE-611

Verify integrity in audit chain (admin only). AS-IS.