← CVE Radar
CVE-2018-8298ChakraCore Scripting Engine Type Confusion Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
7.5 HIGHEPSS 74.69%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 7.6 | HIGH | 2.0NVD | AV:N/AC:H/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Mar 17, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2018-8298
- Status
- Analyzed
- Assigner (CNA)
- microsoft
- Published
- Jul 11, 2018
- Last modified
- 2026-06-17 02:04 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
MicrosoftChakraCore1 version range
- ChakraCore
References
- securityfocus.com http://www.securityfocus.com/bid/104639
- portal.msrc.microsoft.com https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
- exploit-db.com https://www.exploit-db.com/exploits/45217/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298