CVE-2018-0872 — Out-of-bounds Write in Microsoft Chakracore

CWE-787 — Out-of-bounds Write35 documents6 sources

Severity

7.5HIGHNVD

EPSS

28.4%

top 3.47%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Chakracore Msrc Chakracore Msrc Microsoft Edge ON Windows 10 FOR 32-bit Systems +10 more

Timeline

PublishedMar 14

Latest updateMay 13

Description

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages13 packages

▶msrcmsrc/microsoft_edge_on_windows_server_2016

▶msrcmsrc/microsoft_edge_on_windows_10_version_1511_for_32-bit_systems

▶msrcmsrc/microsoft_edge_on_windows_10_version_1607_for_32-bit_systems

▶msrcmsrc/microsoft_edge_on_windows_10_version_1703_for_32-bit_systems

▶msrcmsrc/microsoft_edge_on_windows_10_version_1709_for_32-bit_systems