CVE-2018-8298
Published 2018-07-11 · Updated 2026-06-17 · Source secure@microsoft.com
Summary
CVE-2018-8298 is a high-severity (CVSS 7.5) vulnerability in ChakraCore ChakraCore scripting engine. CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 17, 2022. CISA does not currently list it as used in ransomware campaigns.
All 1 known-exploited ChakraCore vulnerabilities →Description
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: ChakraCore — ChakraCore scripting engine
Name: ChakraCore Scripting Engine Type Confusion Vulnerability
Date added: 2022-03-03 · Due: 2022-03-17
Required action: Apply updates per vendor instructions.
References
- http://www.securityfocus.com/bid/104639
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
- https://www.exploit-db.com/exploits/45217/
- http://www.securityfocus.com/bid/104639
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
- https://www.exploit-db.com/exploits/45217/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298