CVE-2018-8298

Microsoft ChakraCore

Published 11 Jul 2018 · updated 17 Jun 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 17 Mar 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

References

www.securityfocus.com/bid/104639 · Broken Link, Third Party Advisory, VDB Entry
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 · Patch, Vendor Advisory
www.exploit-db.com/exploits/45217/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298 · US Government Resource