ChakraCore · ChakraCore scripting engine

CVE-2018-8298

ChakraCore Scripting Engine Type Confusion Vulnerability

Exploited in attacks High 7.5 Attack chance: 75%

What it is

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

CISA: The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: March 17, 2022

Added to the CISA list: March 3, 2022
Published: July 11, 2018
Severity: High 7.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 75% in the top 0.5% of all known vulnerabilities
Weakness: CWE-843
More details: NVD · CVE.org · CISA

All references (3)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.