Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ChakraCore scripting engine allows attackers to run malicious code remotely.

CVE-2018-8243 · published 8 years ago
Summary

A security weakness in the ChakraCore scripting engine could allow hackers to execute malicious code on a website or application that uses this engine, potentially leading to unauthorized access or data theft. Users should update their software to the latest version to fix this issue.

What to do
  • Update microsoft microsoft.chakracore to version 1.8.5.
Affected software
Ecosystem VendorProductAffected versions
nuget microsoft microsoft.chakracore < 1.8.5
Fix: upgrade to 1.8.5
– microsoft chakracore All versions
cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*
Original advisory text
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCo...
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8267.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.5 High
Exploitation
12% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published14 Jun 2018
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-w4qx-vw2w-q566 · GHSA
CVE-2018-8243 · NVD
Track software like this
Free during beta