Cyber Resilience

CVE-2018-8298

HighCISA KEVActive ExploitationEUVD ExploitedPublic PoC

Published: 11 July 2018

Published
11 July 2018
Modified
28 October 2025
KEV Added
03 March 2022
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.8937 99.6th percentile
Risk Priority 89 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2018-8298 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Chakracore. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, resulting in memory corruption classified under CWE-843. This affects ChakraCore and is tracked separately from multiple related issues in the same engine.

An attacker can exploit the flaw over a network with no privileges required but high attack complexity and user interaction needed, achieving high-impact effects on confidentiality, integrity, and availability.

Microsoft Security Response Center advisories reference the issue for guidance, while public exploit code is listed on Exploit-DB. The CVSS 7.5 score reflects the remote attack surface and potential for full system compromise when triggered.

EU & UK References

Vulnerability details

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

CWE(s)
CWE-843
KEV Date Added
03 March 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
chakracore
≤ 1.10.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-16 Memory Protection good match
prevent

Directly counters the memory corruption (CWE-843) in ChakraCore object handling that enables RCE.

SI-3 Malicious Code Protection partial match
prevent

Blocks or contains malicious script payloads that trigger the ChakraCore flaw before memory corruption occurs.

SI-2 Flaw Remediation good match
prevent

Requires prompt application of vendor patches that remediate the specific ChakraCore scripting-engine vulnerability.

References