7.5
CVSSv3

CVE-2018-8139

Published: 09/05/2018 Updated: 24/08/2020
CVSS v2 Base Score: 7.6 | Impact Score: 10 | Exploitability Score: 4.9
CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6
VMScore: 765
Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Summary

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft edge -

microsoft chakracore

Exploits

/* BoundFunction::NewInstance is used to handle calls to a bound function The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function The problem is, it doesn't care about the CallFlags_ExtraArg flag which indicates that there's an extra argument (newtarg ...
Microsoft Edge Chakra JIT suffers from a bug BoundFunction::NewInstance is used to handle calls to a bound function The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function The problem is, it doesn't care about the CallFlags_NewTarget flag which indica ...

Recent Articles

It's 2018, and a webpage can still pwn your Windows PC – and apps can escape Hyper-V
The Register • Chris Williams, Editor in Chief • 09 May 2018

Scores of bugs, from Edge and Office to kernel code to Adobe Flash, need fixing ASAP

Patch Tuesday Microsoft and Adobe have patched a bunch of security bugs in their products that can be exploited by hackers to commandeer vulnerable computers, siphon people's personal information, and so on. Redmond emitted 68 patches alone, 21 rated critical and at least two being actively exploited in the wild. There are browser and kernel patches you should look into first, check out an Office 365 email filter bypass that isn't addressed, then Hyper-V if you're using that, and then the rest. ...