CVE-2018-8298 kev in the critical feed json
ChakraCore RCE Vulnerability
published 2018-07-11 8 y ago modified 2026-06-17 4 mo ago also GHSA-wgw2-wwq8-c7wf , EUVD-2022-5575
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-03-03
- epss
- 74.7%
- EPSS 74.7% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 1
- Exploit-DB
Summary
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Patch / fix
cisa required action Apply updates per vendor instructions.
- nuget Microsoft.ChakraCore 1.10.1
- microsoft chakracore 1.10.1
Timeline
- Published
- First public exploit (EDB-45217)
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-03-17 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- ChakraCore, ChakraCore scripting engine
- CISA name
- ChakraCore Scripting Engine Type Confusion Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
74.69% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-45217 Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion dos, 2018-08-17
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.ChakraCore | <1.10.1 |
1.10.1 |
Affected products
- Microsoft ChakraCore
Classification
- Weakness
-
- CWE-843 Access of Resource Using Incompatible Type
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2018-8298
web, patch, vendor-advisory
-
github.com
/chakra-core/ChakraCore/pull/5444
web
-
github.com
/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86
web
-
exploit-db.com
/exploits/45217/
exploit, third-party-advisory, vdb-entry
-
securityfocus.com
/bid/104639
vdb-entry, broken-link, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298
government-resource, web, us-government-resource
-
nvd.nist.gov
/vuln/detail/CVE-2018-8298
advisory
-
github.com
/chakra-core/ChakraCore
package
-
web.archive.org
/web/20210124183835/http://www.securityfocus.com/bid/104639
web
-
exploit-db.com
/exploits/45217
web
Sources
- CVE List CVE-2018-8298
- GitHub Advisory GHSA-wgw2-wwq8-c7wf
- NVD CVE-2018-8298
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.