CVE-2016-0193
published 2016-05-11CVE-2016-0193: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
PriorityP273high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
20.08%
97.1th percentile
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | microsoft_edge_on_windows_10_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_for_x64-based_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1511_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1511_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability exists in the Chakra JavaScript engine (Microsoft Edge) — target scripting engine memory corruption via crafted web content ↗
- →Attack vector is a specially crafted website or an ActiveX control marked 'safe for initialization' embedded in an application or Office document hosting the browser rendering engine ↗
- ·Exploit Status rated 'Exploitation More Likely' for latest software release; no public exploit or in-the-wild exploitation confirmed at time of advisory ↗
- ·This is a distinct vulnerability from CVE-2016-0186 and CVE-2016-0191, which are also Chakra scripting engine memory corruption issues — ensure detections differentiate between the three ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
vendor_msrc7.5CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-14·CVSS 7.5
CVE-2016-0191 [HIGH] CWE-119 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.
OSV
ChakraCore RCE Vulnerability
osv·2022-05-14·CVSS 7.5
CVE-2016-0191 [HIGH] ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.
OSV
ChakraCore RCE Vulnerability
osv·2022-05-14·CVSS 7.5
CVE-2016-0193 [HIGH] ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
OSV
ChakraCore RCE Vulnerability
osv·2022-05-14·CVSS 7.5
CVE-2016-0186 [HIGH] ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and CVE-2016-0193.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-14·CVSS 7.5
CVE-2016-0186 [HIGH] CWE-119 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and CVE-2016-0193.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-14·CVSS 7.5
CVE-2016-0193 [HIGH] CWE-119 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
VulnCheck
Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2016·CVSS 7.5
CVE-2016-0191 [HIGH] Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.
Affected: Microsoft Edge
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dl.acm.org/doi/pdf/10.1145/3465481.3465758
VulnCheck
Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2016·CVSS 7.5
CVE-2016-0193 [HIGH] Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft Edge Improper Restriction of Operations within the Bounds of a Memory Buffer
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
Affected: Microsoft Edge
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dl.acm.org/doi/pdf/10.1145/3465481.3465758
Microsoft
Scripting Engine Memory Corruption Vulnerability
vendor_msrc·2016-05-10·CVSS 7.5
CVE-2016-0193 [HIGH] Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
Description: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website d
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: OpenJPEG JPEG2000 mcc record Code Execution Vulnerability
blogs_talos·2016-10-01·CVSS 7.5
CVE-2016-8332 [HIGH] Vulnerability Spotlight: OpenJPEG JPEG2000 mcc record Code Execution Vulnerability
Vulnerability discovered by Aleksandar Nikolic of Cisco Talos
## Overview Talos has identified an exploitable out-of-bounds vulnerability in the JPEG 2000 image file format parser implemented in OpenJPEG library (TALOS-2016-0193/CVE-2016-8332). The JPEG 2000 file format is commonly used for embedding images inside PDF documents. This particular vulnerability could allow an out-of-bound heap write to occur, resulting in heap corruption and lead to arbitrary code execution. Talos has disclosed this vulnerability responsibily to the library maintainers to ensure a patch is available.
Exploitation of this vulnerability is possible if a user were to open a file containing a specifically crafted JPEG 2000 image that exploits this flaw. Examples where this could be achieved would be in an email
Zscaler
Zscaler found Multiple Security Vulnerabilities | 05-11-2016
blogs_zscaler·CVSS 7.5
[HIGH] Zscaler found Multiple Security Vulnerabilities | 05-11-2016
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bugzilla
CVE-2016-8332 openjpeg2: JPEG2000 mcc record Code Execution Vulnerability
bugzilla·2016-10-03·CVSS 7.5
CVE-2016-8332 [HIGH] CVE-2016-8332 openjpeg2: JPEG2000 mcc record Code Execution Vulnerability
CVE-2016-8332 openjpeg2: JPEG2000 mcc record Code Execution Vulnerability
An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
External References:
http://www.talosintelligence.com/reports/TALOS-2016-0193/
Discussion:
Created openjpeg2 tracking bugs for this issue:
Affects: fedora-all [bug 13
http://www.securityfocus.com/bid/90009http://www.securitytracker.com/id/1035821http://www.zerodayinitiative.com/advisories/ZDI-16-283https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-052http://www.securityfocus.com/bid/90009http://www.securitytracker.com/id/1035821http://www.zerodayinitiative.com/advisories/ZDI-16-283https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-052
2016-05-11
Published
Exploited in the wild