cbcvebase.
CVE-2018-8353
published 2018-08-15

CVE-2018-8353: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory…

PriorityP269high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
67.69%
99.2th percentile
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.

Affected

14 ranges
VendorProductVersion rangeFixed in
microsoftchakracore<= 1.10.1
microsoftchakracore
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
msrcinternet_explorer_10
msrcinternet_explorer_11
msrcinternet_explorer_9

Detection & IOCsextracted from sources · hover to see the quote

processjscript!PrepareInvoke+0x2b1
commandregexps[magicIndex + 6].lastIndex / 4.9406564584124654E-324 - 0x560
  • Exploit uses a specially crafted NameList allocation of exactly 0x970 bytes (via a 570-char repeated 'a' property name) to reclaim freed memory; heap allocations of size 0x970 in jscript.dll context during IE scripting may indicate exploitation attempts.
  • Exploit targets IE in 64-bit single process mode enabled via TabProcGrowth registry flag; monitor for unusual TabProcGrowth registry modifications that force IE into single-process mode, which may indicate exploit staging.
  • The exploit uses a magic marker value 0x1337 embedded in a specially crafted property name string to identify the reallocated object; scanning JScript heap or memory dumps for this marker alongside UAF patterns may indicate active exploitation.
  • Call stack for exploitation passes through jscript!VAR::InvokeByDispID, jscript!CScriptRuntime::Run, and MSHTML!CActiveScriptHolder::ParseScriptText; this call chain in crash telemetry or ETW traces is indicative of in-the-wild exploitation of this UAF.
  • ·The published exploit (Exploit-DB 45279) is incomplete — it only leaks a heap address and does not achieve full code execution; structure sizes and offsets are specific to 64-bit single-process IE mode and would differ in the default 32-bit process.
  • ·Microsoft assessed exploitation as 'More Likely' for both latest and older software releases at time of patch, despite no confirmed in-the-wild exploitation at disclosure.
  • ·The exploit reliability note mentions that triggering the Low Fragmentation Heap (LFH) for the 0x970 allocation size was not implemented and would likely improve reliability.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
vendor_msrc6.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.