CVE-2018-8137 — Out-of-bounds Write in Microsoft Chakracore

CWE-787 — Out-of-bounds Write CWE-125 — Out-of-bounds Read55 documents10 sources

Severity

7.5HIGHNVD

EPSS

22.7%

top 4.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Chakracore Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 +3 more

Timeline

PublishedMay 9

Latest updateMay 1

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8139.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/microsoft_edge11 versions+10

▶NVDmicrosoft/chakracore1.8.3

▶CVEListV5microsoft/chakracoreChakraCore

▶NVDmicrosoft/internet_explorer10, 11, 9+2

▶CVEListV5microsoft/internet_explorer_9Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

OSV

ChakraCore RCE Vulnerability↗2022-05-13

▶

GHSA

ChakraCore RCE Vulnerability↗2022-05-13

▶

GHSA

GHSA-62p4-hcq9-29cq: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine M↗2022-05-13

▶

OSV

ChakraCore RCE Vulnerability↗2022-05-13

▶

GHSA

GHSA-73gm-rwrw-qwv2: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine M↗2022-05-13

▶

📋Vendor Advisories

Microsoft

Scripting Engine Memory Corruption Vulnerability↗2018-05-08

▶