CVE-2018-8353 in the critical feed json
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scri…
published 2018-08-15 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-20004
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 67.3%
- EPSS 67.3% chance of exploitation in 30 days, percentile 99.3%
- public exploits
- 1
- Exploit-DB
Summary
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
Patch / fix
Timeline
- Published
- First public exploit (EDB-45279)
Exploit prediction
67.34% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-45279 Microsoft Windows - JScript RegExp.lastIndex Use-After-Free dos, 2018-08-28
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2018-8353
patch, vendor-advisory
-
exploit-db.com
/exploits/45279/
exploit, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1041483
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/105034
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-8353
- NVD CVE-2018-8353
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.