What’s Vulnerable › Vulnerabilities

CVE-2018-8298: ChakraCore Scripting Engine Type Confusion Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-03
• EPSS: 74.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-11 · updated 2026-06-17
• Weakness: CWE-843

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Affected products

• Microsoft ChakraCore: before 1.10.1 — fixed in 1.10.1
• Microsoft ChakraCore: ChakraCore

How to fix

Upgrade to a fixed version: Microsoft ChakraCore 1.10.1. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/104639
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
• https://www.exploit-db.com/exploits/45217/
• http://www.securityfocus.com/bid/104639
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
• https://www.exploit-db.com/exploits/45217/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298

Get alerted when CVE-2018-8298 or the next vulnerability affects your stack