Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-0891 — Missing Release of Memory after Effective Lifetime in Microsoft Internet Explorer

CWE-401 — Missing Release of Memory after Effective Lifetime CWE-787 — Out-of-bounds Write6 documents6 sources

Severity

4.3MEDIUMNVD

EPSS

56.6%

top 1.87%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Microsoft Internet Explorer

Timeline

PublishedMar 14

Latest updateMay 13

Description

ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0939.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶NVDmicrosoft/internet_explorer10, 11, 9+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-qpvj-752h-7r4r: ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8↗2022-05-13

▶

GHSA

ChakraCore information disclosure vulnerability↗2022-05-13

▶

CVEList

CVE-2018-0891: ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8↗2018-03-14

▶

💥Exploits & PoCs

Exploit-DB

Internet Explorer - 'RegExp.lastMatch' Memory Disclosure↗2018-03-20

▶

📋Vendor Advisories

Microsoft

Scripting Engine Information Disclosure Vulnerability↗2018-03-13

▶