CVE-2018-8133 — Out-of-bounds Write in Microsoft Chakracore

CWE-787 — Out-of-bounds Write CWE-200 — Sensitive Information Exposure CWE-843 — Type Confusion31 documents10 sources

Severity

7.5HIGHNVD

EPSS

62.3%

top 1.63%

CISA KEV

Not in KEV

Exploit

Exploited in wild

Active exploitation observed

Affected products

Microsoft Chakracore Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 +2 more

Timeline

PublishedMay 9

Latest updateMay 13

Description

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8145, CVE-2018-8177.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages6 packages

▶NVDmicrosoft/chakracore1.8.3

▶CVEListV5microsoft/chakracoreChakraCore

▶CVEListV5microsoft/microsoft_edge11 versions+10

▶NVDmicrosoft/internet_explorer10, 11+1

▶CVEListV5microsoft/internet_explorer_10Windows Server 2012

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

ChakraCore RCE Vulnerability↗2022-05-13

▶

GHSA

ChakraCore RCE Vulnerability↗2022-05-13

▶

GHSA

ChakraCore information disclosure vulnerability↗2022-05-13

▶

OSV

ChakraCore information disclosure vulnerability↗2022-05-13

▶

OSV

ChakraCore RCE Vulnerability↗2022-05-13

▶

💥Exploits & PoCs

Exploit-DB

Microsoft Edge Chakra - EntrySimpleObjectSlotGetter Type Confusion↗2018-05-31

▶

📋Vendor Advisories

Microsoft

Chakra Scripting Engine Memory Corruption Vulnerability↗2018-05-08

▶