cbcvebase.
CVE-2018-0946
published 2018-05-09

CVE-2018-0946: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory…

PriorityP264high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
51.42%
98.8th percentile
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.

Affected

14 ranges
VendorProductVersion rangeFixed in
microsoftchakracore<= 1.8.3
microsoftchakracore
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
microsoftmicrosoft_edge
microsoftmicrosoft_edge
msrcchakracore
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_x64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

otherMS.Edge.Chakra.DataView.Object.Cross.Context.UAF
filenamechakra.dll
versionchakra.dll 11.00.14393.447
  • Trigger condition: a DataView object from one iframe context accesses optimized JIT-compiled function code belonging to another context after that context has been closed (f.src = 'about:blank'), resulting in a use-after-free in chakra.dll.
  • The vulnerability is triggered via a cross-context DataView object that bypasses CrossSite wrapping; the MarshalToScriptContext method does not wrap the ArrayBuffer returned by DataView, allowing the unwrapped object to escape its context.
  • PoC attack pattern: iframe is created, cross-context eval runs a function 'opt' that is JIT-optimized in a loop, then the iframe is navigated to about:blank to free the JIT code, followed by calling opt() from the parent context to trigger UAF.
  • ·Analysis and assembly offsets are specific to chakra.dll version 11.00.14393.447; behavior and offsets will differ on other versions.
  • ·Microsoft's own advisory notes the exploit status as 'Publicly Disclosed: No; Exploited: No' at time of patch, meaning no in-the-wild exploitation was confirmed.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.