Actively exploited · Published Jul 11, 2018 · Assigned by microsoft

CVE-2018-8298

High 7.5 Exploited

In plain English

A high-severity type confusion in ChakraCore from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 74.7% (higher than 99.5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)74.7%top 0.5% of all CVEs

Exploited in the wildYesCISA KEV since Mar 3, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 17, 2022.

Official description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	microsoft.chakracore	1.10.1	GHSA-wgw2-wwq8-c7wf

Affected products (as reported)

Vendor	Product	Versions
Microsoft	ChakraCore	ChakraCore

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 x_refsource_CONFIRM
104639 vdb-entry, x_refsource_BID
45217 exploit, x_refsource_EXPLOIT-DB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298 government-resource