PT-2018-2018 · Microsoft · Chakracore

Published 2018-07-10 · Updated 2025-10-28 · CVE-2018-8298

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ChakraCore (affected versions not specified)

Description The issue is related to a type confusion vulnerability in the ChakraCore Scripting Engine, which is associated with errors in the mechanisms for processing objects in memory. Exploitation of this issue may allow a remote attacker to execute arbitrary code with the privileges of the current user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Buffer Overflow

Weakness Enumeration

CWE-843

CWE-119

Related Identifiers

BDU:2018-01634

CVE-2018-8298

GHSA-WGW2-WWQ8-C7WF

Affected Products

Chakracore

References · 16

• 🔥 https://exploit-db.com/exploits/45217 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8298 · Security Note
• https://bdu.fstec.ru/vul/2018-01634 · Security Note
• https://osv.dev/vulnerability/GHSA-wgw2-wwq8-c7wf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8298 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 · Vendor Advisory
• https://github.com/chakra-core/ChakraCore · Note
• https://github.com/chakra-core/ChakraCore/pull/5444 · Note
• https://github.com/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86 · Note
• https://web.archive.org/web/20210124183835/http://securityfocus.com/bid/104639 · Note
• https://t.me/cveNotify/140659 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298 · Note
• http://securityfocus.com/bid/104639 · Note
• https://cxsecurity.com/issue/WLB-2018080116 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note