CVE-2018-8298highunder attackCWE-843

CVE-2018-8298: high-severity vulnerability in Microsoft ChakraCore

Published · Updated

Follow this CVE+ Monitor ChakraCore+ Monitor ChakraCore scripting engine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.5epss 75%
from disclosure to weapon37 days
Published on NVDJul 11
1st PoC+37d
CISA KEV+1331d
Action required by CISAfederal deadline: 2022-03-17

Apply updates per vendor instructions.

In short

A memory corruption flaw in ChakraCore's JavaScript engine allows attackers to run malicious code remotely by crafting specially designed objects that corrupt memory when processed.

Technical detail

CWE-843 type confusion/object memory corruption in ChakraCore's object handling enables remote code execution without authentication. Attack vector is network-based through malicious scripts; exploitation requires the engine to process a crafted object that triggers unsafe memory operations leading to arbitrary code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft · ChakraCore
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft ChakraCore

In the same product, most dangerous first.

CVE-2020-0878MEDIUMMicrosoft Browser Memory Corruption VulnerabilityEPSS 2.7%KEVCVE-2019-0539—CVE-2019-0539EPSS 82.9%CVE-2019-0567—CVE-2019-0567EPSS 80.1%CVE-2018-8279—CVE-2018-8279EPSS 70.7%CVE-2018-8229—CVE-2018-8229EPSS 70.6%CVE-2019-0568—CVE-2019-0568EPSS 69.5%